MEDIUM6.5

GHSA-j66f-h9hm-975m

Unrestricted Upload of File with Dangerous Type in Umbraco CMS

Quick fix

GHSA-j66f-h9hm-975m — UmbracoCms: upgrade to the fixed version with the command below.

dotnet add package UmbracoCms --version 8.5.4

Details

Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.

Enter the version of the package you're using.

Introduced in: 0Fixed in: 8.5.4

Fixdotnet add package UmbracoCms --version 8.5.4