| Package | Affected versions | Patched versions |
|---|---|---|
| Umbraco.CMS | ≥ 11.0.0, < 12.3.4≥ 8.0.0, < 8.18.10≥ 9.0.0, < 10.8.1 | 12.3.48.18.1010.8.1 |
| umbraco cms | ≥ 10.0.0, < 10.8.1≥ 12.0.0, < 12.3.0≥ 8.0.0, < 8.18.10 | 10.8.112.3.08.18.10 |
Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location.
The “Package” section in Umbraco Backoffice allows a logged in user to write folders outside of the default package directory.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free