CVE-2025-32017

Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.

• CWE-23

• https://github.com/umbraco/Umbraco-CMS/commit/06a2a500b358ce15b1e228391eb60bd517c6e833Patch
• https://github.com/umbraco/Umbraco-CMS/commit/d3c1443b14b1076faf13d1bcecc42860fdf5fad8Patch
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-q62r-8ppj-xvf4Patch, Third Party Advisory

Published

Apr 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32011KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authent…9.8
• CVE-2025-32012Jellyfin is an open source self hosted media server. In vers…7.5
• CVE-2025-32013LNbits is a Lightning wallet and accounts system. A Server-S…7.5
• CVE-2025-32014estree-util-value-to-estree converts a JavaScript value to a…6.9
• CVE-2025-32015FreshRSS is a self-hosted RSS feed aggregator. Prior to vers…6.7
• CVE-2025-32016Microsoft Identity Web is a library which contains a set of …4.7
• CVE-2025-32018Cursor is a code editor built for programming with AI. In ve…8
• CVE-2025-32019Harbor is an open source trusted cloud native registry proje…4.1
• CVE-2025-3202A vulnerability classified as critical has been found in age…9.1
• CVE-2025-32020The crud-query-parser library parses query parameters from H…9.3
• CVE-2025-32021Weblate is a web based localization tool. Prior to version 5…7.5
• CVE-2025-32022Finit provides fast init for Linux systems. Finit's urandom …4.6