CVE-2025-67288
Last modified
CVE-2025-67288 is a critical-severity vulnerability rated 10/10 on the CVSS scale. An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself. EPSS estimates a 0.50% chance of exploitation in the next 30 days.
Description
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself. The Supplier also states that PDF JavaScript runs in a completely isolated sandbox, not the browser's DOM context, which means that privilege boundaries would not be crossed, a related issue to CVE-2023-49279.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Umbraco | Umbraco Cms | 16.3.3 |
References
- https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67288Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-67288?
How severe is CVE-2025-67288?
How do I fix CVE-2025-67288?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-67278An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW befor…6.5
- CVE-2025-67279An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW befor…5.3
- CVE-2025-67280In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate …5.4
- CVE-2025-67281In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL inject…5.4
- CVE-2025-67282In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorizat…5.4
- CVE-2025-67285A SQL injection vulnerability was found in the '/cts/admin/?…7.3
- CVE-2025-67289An arbitrary file upload vulnerability in the Attachments mo…9.6
- CVE-2025-6729The PayMaster for WooCommerce plugin for WordPress is vulner…6.4
- CVE-2025-67290A stored cross-site scripting (XSS) vulnerability in the Pag…6.1
- CVE-2025-67291A stored cross-site scripting (XSS) vulnerability in the Med…6.1
- CVE-2025-67298An issue in ClasroomIO before v.0.2.6 allows a remote attack…8.1
- CVE-2025-6730The Bonanza – WooCommerce Free Gifts Lite plugin for WordPre…4.3
Are you affected by CVE-2025-67288?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST