CVE-2025-66625
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Umbraco, an ASP.NET CMS, in versions 10.0.0 through 13.12.0 unsafely handles and deletes temporary files during dictionary upload. An attacker with backoffice access can trigger predictable requests to temporary file paths, and error responses (HTTP 500 when a file exists, 404 when it does not) allow enumeration of arbitrary files on the server filesystem.
Risk Assessment
An attacker can determine which files exist on the server, and in certain configurations may also expose the NTLM hash of the Windows account running the Umbraco application.
Recommendation
Update Umbraco to version 13.12.1 or later.
Other vulnerabilities in Umbraco
See all- CVE-2015-8814High
Umbraco before version 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks, as demonstrated by editing user account information in the templates.asmx.cs file.
- CVE-2012-1301Critical
The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the 'url' parameter.
- CVE-2026-69197High
Umbraco prior to 13.15.1, 17.5.3, and 18.0.2, in the Content Delivery API, applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values.
Original NVD description (English source)
Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error responses (HTTP 500 when a file exists, 404 when it does not) allow the attacker to enumerate the existence of arbitrary files on the server’s filesystem. This vulnerability does not allow reading or writing file contents. In certain configurations, incomplete clean-up of temporary upload files may additionally expose the NTLM hash of the Windows account running the Umbraco application. This issue is fixed in version 13.12.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS