Description
Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| umbraco | Umbraco-CMS | >= 14.0.0--preview004, < 14.3.4, >= 15.0.0-rc1, < 15.3.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Umbraco.Cms | >= 14.0.0--preview004, < 14.3.4 | 14.3.4 | GHSA-q62r-8ppj-xvf4 |
| NuGet | Umbraco.Cms | >= 15.0.0-rc1, < 15.3.1 | 15.3.1 | GHSA-q62r-8ppj-xvf4 |