https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T08:26:30.022706+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-00060 bdu:2026-00060 2026-10-09T08:26:30.025423+00:00 bdu:2026-00060 https://cve.radiocsirt.org/vuln/euvd-2026-228061 EUVD-2026-228061 2026-10-09T08:26:30.025457+00:00 EUVD-2026-228061 https://cve.radiocsirt.org/vuln/fkie_cve-2025-32017 fkie_cve-2025-32017 2026-10-09T08:26:30.025471+00:00

Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.

 https://cve.radiocsirt.org/vuln/ghsa-q62r-8ppj-xvf4 GHSA-q62r-8ppj-xvf4 — Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users 2026-10-09T08:26:30.025500+00:00

Affected: NuGet: Umbraco.Cms

### Impact Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location.

### Patches The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.

### Workarounds Umbraco supports the configuration of [allowed](https://docs.umbraco.com/umbraco-cms/reference/configuration/contentsettings#allowed-upload-file-extensions) and [disallowed file extensions](https://docs.umbraco.com/umbraco-cms/reference/configuration/contentsettings#disallowed-upload-file-extensions). Using these options to allow only necessary file extensions significantly reduces the scope of the vulnerability.