CVE-2023-49089: fallo de gravedad alta en Umbraco-CMS
Umbraco CMS possible path traversal when creating packages from backoffice
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.7epss 0.6%
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Productos afectados
umbraco · Umbraco-CMSCVEs relacionadas — Umbraco-CMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-24011MEDIUMUmbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response CodesEPSS 1.6%CVE-2023-37267HIGHUmbraco allows possible Admin-level access to backoffice without Auth under rare conditionsEPSS 0.7%CVE-2026-69197HIGHUmbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansionEPSS 0.7%CVE-2025-32017HIGHUmbraco has a Management API Vulnerability to Path Traversal With Authenticated UsersEPSS 0.6%CVE-2023-49278MEDIUMUmbraco CMS brute force exploit can be used to collect valid usernamesEPSS 0.5%CVE-2026-117553HIGHUmbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header PoisoningEPSS 0.5%