CVE-2025-48953: Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
Impact Via a manipulated API request it's possible to upload a file that doesn't adhere with the configured allowable file extensions.
Patches Patched in 15.4.2 and 16.0.0.
Workarounds None available.
Other sources
Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and 16.0.0. No known workarounds are available.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48953?
CVE-2025-48953 has a high severity due to the potential for unauthorized file uploads.
How do I fix CVE-2025-48953?
To fix CVE-2025-48953, upgrade to Umbraco versions 15.4.2 or 16.0.0.
What versions of Umbraco are affected by CVE-2025-48953?
CVE-2025-48953 affects Umbraco versions starting from 14.0.0 up to, but not including, 15.4.2 and 16.0.0.
What type of vulnerability is CVE-2025-48953?
CVE-2025-48953 is a file upload vulnerability that allows files outside the allowed extensions to be uploaded.
Is there a workaround for CVE-2025-48953?
There are no known workarounds for CVE-2025-48953; upgrading is the recommended solution.