5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48953

CVE-2025-48953: Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Impact

Via a manipulated API request it's possible to upload a file that doesn't adhere with the configured allowable file extensions.

Patches

Patched in 15.4.2 and 16.0.0.

Workarounds

None available.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48953

CVE-2025-48953:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Umbraco.Cms	nuget	>= 14.0.0, <= 15.4.1	15.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows bypassing configured allowed file extensions for uploads. The provided commit d920e93d1ee29dc3301697e444f53e8cd5db3cf9 directly addresses this by modifying the IsFileAllowedForUpload function in ContentSettingsExtensions.cs. The key change is the addition of .Trim() to the input extension before it's compared against the allowed and disallowed lists. This implies that the vulnerability was due to the system not correctly handling file extensions with leading or trailing whitespace. An attacker could have crafted an API request with a filename like malicious.php (note the trailing space). If php was disallowed but php was not explicitly handled or trimmed, the upload might have been permitted. The function IsFileAllowedForUpload is central to this check and, in its pre-patch state, would be the function processing the malicious input (the crafted extension) and incorrectly allowing the upload.

The new test cases added in ContentSettingsExtensionsTests.cs further confirm this by explicitly testing extensions with trailing spaces (e.g., "jpg ", "gif "). The tests IsFileAllowedForUpload_Allows_File_In_Allow_List and IsFileAllowedForUpload_Rejects_File_In_Disallow_List now pass with these space-padded extensions, indicating the fix correctly handles them. Before the fix, these tests with space-padded extensions would likely have failed or behaved inconsistently depending on the exact allow/disallow list configuration, demonstrating the bypass vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-48953: Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Impact

Patches

Workarounds

CVE-2025-48953:

5.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

5.5

5.5

Basic Information

Basic Information

CVE-2025-48953: Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Impact

Patches

Workarounds

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI