Umbraco CMS possible path traversal when creating packages from backoffice

published 2023-12-12 2 y ago modified 2026-09-10 1 mo ago also GHSA-6324-52pr-h4p5 , EUVD-2023-3121

cvss: 7.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue.

Patch / fix

fixed in 2

nuget Umbraco.CMS 8.18.10, 10.8.1, 12.3.4
umbraco umbraco_cms 8.18.10, 10.8.1, 12.3.0

Exploit prediction

0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
GitHub	3.1	0.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
nuget	Umbraco.CMS	>=8.0.0, <8.18.10 >=9.0.0, <10.8.1 >=11.0.0, <12.3.4	8.18.10 10.8.1 12.3.4

Affected products

umbraco Umbraco-CMS

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

github.com /umbraco/Umbraco-CMS/security/advisories/GHSA-6324-52pr-h4p5
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2023-49089
advisory
github.com /umbraco/Umbraco-CMS
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary