An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself.
References
| Link | Resource |
|---|---|
| http://umbraco.com | Product |
| https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67288 | Third Party Advisory |
Configurations
History
02 Jan 2026, 17:46
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Umbraco
Umbraco umbraco Cms |
|
| CPE | cpe:2.3:a:umbraco:umbraco_cms:16.3.3:*:*:*:*:*:*:* | |
| References | () http://umbraco.com - Product | |
| References | () https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67288 - Third Party Advisory |
02 Jan 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself. |
22 Dec 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-22 19:15
Updated : 2026-01-02 17:46
NVD link : CVE-2025-67288
Mitre link : CVE-2025-67288
CVE.ORG link : CVE-2025-67288
JSON object : View
Products Affected
umbraco
- umbraco_cms
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type