—0.0
GHSA-6324-52pr-h4p5
Using the directory back payload (“/../”) in a package name allows placement of package in other folders.
Quick fix
GHSA-6324-52pr-h4p5 — Umbraco.CMS: upgrade to the fixed version with the command below.
dotnet add package Umbraco.CMS --version 8.18.10Details
#### Impact Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location.
#### Explanation of the vulnerability The “Package” section in Umbraco Backoffice allows a logged in user to write folders outside of the default package directory.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/Umbraco.CMS
Introduced in:
8.0.0Fixed in: 8.18.10Fix
dotnet add package Umbraco.CMS --version 8.18.10NuGet/Umbraco.CMS
Introduced in:
9.0.0Fixed in: 10.8.1Fix
dotnet add package Umbraco.CMS --version 10.8.1NuGet/Umbraco.CMS
Introduced in:
11.0.0Fixed in: 12.3.4Fix
dotnet add package Umbraco.CMS --version 12.3.4