Medium · 6.5 CVE-2020-9472 EUVD-2021-1768GHSA-j66f-h9hm-975m

Unrestricted Upload of File with Dangerous Type in Umbraco CMS

Published Mar 16, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Description

Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.

Ecosystem	Package	Affected	Fixed	Record
NuGet	UmbracoCms	< 8.5.4	8.5.4	GHSA-j66f-h9hm-975m