CVE-2025-67288 claims an arbitrary file upload flaw in Umbraco CMS 16.3.3, scored critical (CVSS 10.0) in the record. The supplier disputes it. There is no fixed version to install, so the useful action is to check how your site validates uploaded files.
What's affected
Umbraco CMS 16.3.3 is the version named in the record. The record carries an explicit dispute note, and it matters, so here are both positions.
The reporter says an attacker can execute arbitrary code by uploading a crafted PDF. The supplier says responsibility for file validation, as the documentation describes, belongs to the administrator who deploys Umbraco in their environment. It also says that JavaScript inside a PDF runs in an isolated sandbox, not in the browser page context, so privilege boundaries are not crossed. The note mentions a related issue, CVE-2023-49279.
No fixed version exists in the record, and the only reference is the reporter's repository. I did not fetch it, so I cannot add technical detail beyond the record.
How to check if you're exposed
Because the dispute is about who validates uploads, the practical check is about your own deployment, not a version number.
Confirm your Umbraco version in the backoffice settings. Then review the upload path:
grep -n "AllowedUploadedFileExtensions\|DisallowedUploadedFileExtensions" appsettings*.json
These settings control which file types the media library accepts. Check what your configuration allows, who can upload, and whether uploaded files are served from the same origin as the admin area. Also review web server rules that decide whether anything in the media folder can be executed.
What to do now
- Record the Umbraco version in use and whether media upload is open to anonymous or low privilege users.
- Restrict uploads to the file types you actually need, and disallow executable or script types.
- Make sure the media folder is served as static content and that the web server never executes files from it.
- Limit who can upload in the backoffice, and require strong authentication for those accounts.
- Subscribe to Umbraco release notes and re-check this CVE if the supplier changes its position.
Why it matters
The weakness class is CWE-434, unrestricted upload of a file with a dangerous type. In many real incidents, the flaw is not in the CMS itself but in a deployment that lets uploaded files reach an execution path. That is the supplier's argument here.
Disputed CVEs are awkward for scanners. A tool will report a 10.0 against your site even though the supplier says the behavior is by design. The right response is neither panic nor dismissal: document the dispute, harden validation, and keep the finding visible. The record does not list this CVE as known exploited.
Quick check
Should I ignore this CVE because it is disputed?
No. Note the dispute, but still check your upload validation, because unrestricted uploads cause real problems in any CMS.
Is there a patched Umbraco version?
The record does not name one. Check Umbraco release notes before assuming either way.
Sources
- Safeguard Gold page for CVE-2025-67288
- Reporter write-up listed in the record (not fetched; cited as given)
Last reviewed: 18 October 2026.
