CVE-2025-66625
published 2025-12-09CVE-2025-66625: Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an…
PriorityP433medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
EPSS
0.30%
21.7th percentile
Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error responses (HTTP 500 when a file exists, 404 when it does not) allow the attacker to enumerate the existence of arbitrary files on the server’s filesystem. This vulnerability does not allow reading or writing file contents. In certain configurations, incomplete clean-up of temporary upload files may additionally expose the NTLM hash of the Windows account running the Umbraco application. This issue is fixed in version 13.12.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| umbraco | umbraco-cms | — | — |
| umbraco | umbraco_cms | >= 10.0.0 < 13.12.1 | 13.12.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality
osv·2025-12-09
CVE-2025-66625 [MEDIUM] Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality
Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality
### Impact
Due to unsafe handling and deletion of temporary files during the dictionary upload process, an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error responses (HTTP 500 when a file exists, 404 when it does not) allow the attacker to enumerate the existence of arbitrary files on the server’s filesystem. This vulnerability does not allow reading or writing file contents.
In certain configurations, incomplete clean-up of temporary upload files may additionally expose the NTLM hash of the Windows account running the Umbraco application. The direct impact of this vulnerability is therefore limited to confidentialit
GHSA
Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality
ghsa·2025-12-09
CVE-2025-66625 [MEDIUM] CWE-200 Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality
Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality
### Impact
Due to unsafe handling and deletion of temporary files during the dictionary upload process, an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error responses (HTTP 500 when a file exists, 404 when it does not) allow the attacker to enumerate the existence of arbitrary files on the server’s filesystem. This vulnerability does not allow reading or writing file contents.
In certain configurations, incomplete clean-up of temporary upload files may additionally expose the NTLM hash of the Windows account running the Umbraco application. The direct impact of this vulnerability is therefore limited to confidentialit
No detection rules found.
No public exploits indexed.
2025-12-09
Published