GHSA-q62r-8ppj-xvf4
Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
상세
### Impact Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location.
### Patches The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.
### Workarounds Umbraco supports the configuration of [allowed](https://docs.umbraco.com/umbraco-cms/reference/configuration/contentsettings#allowed-upload-file-extensions) and [disallowed file extensions](https://docs.umbraco.com/umbraco-cms/reference/configuration/contentsettings#disallowed-upload-file-extensions). Using these options to allow only necessary file extensions significantly reduces the scope of the vulnerability.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
14.0.0--preview004 수정 버전: 14.3.4 dotnet add package Umbraco.Cms --version 14.3.4 15.0.0-rc1 수정 버전: 15.3.1 dotnet add package Umbraco.Cms --version 15.3.1 참고
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-q62r-8ppj-xvf4 [WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2025-32017 [ADVISORY]
- https://github.com/umbraco/Umbraco-CMS/commit/06a2a500b358ce15b1e228391eb60bd517c6e833 [WEB]
- https://github.com/umbraco/Umbraco-CMS/commit/d3c1443b14b1076faf13d1bcecc42860fdf5fad8 [WEB]
- https://github.com/umbraco/Umbraco-CMS [PACKAGE]