CVE-2025-66625Published

Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality

cve-program · CVE-2025-66625

Published

Umbraco-CMS

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "umbraco",
                    "product": "Umbraco-CMS",
                    "versions": [
                        {
                            "version": "10.0.0, < 13.12.1",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-202178

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Dec 9, 2025, 8:09:27 PM

dateUpdated: Dec 12, 2025, 8:33:09 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-66625

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-200 · CWE-377 · CWE-552

Original publisher date fields

published: 2025-12-09T20:15:55.320

lastModified: 2026-10-14T21:10:00.183

1 source CPE criteria · context only

cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-hfv2-pf68-m33x

Published

Umbraco.Cms

NuGet

ECOSYSTEM · introduced 10.0.0 → fixed 13.12.1

138 explicitly affected versions

10.0.0, 10.0.1, 10.1.0, 10.1.0-rc, 10.1.0-rc2, 10.1.1, 10.2.0, 10.2.0-rc, 10.2.1, 10.3.0, 10.3.0-rc, 10.3.1, 10.3.2, 10.4.0, 10.4.0-rc, 10.4.1, 10.4.2, 10.5.0, 10.5.0-rc, 10.5.1, 10.6.0, 10.6.0-rc, 10.6.1, 10.7.0, 10.7.0-rc, 10.8.0, 10.8.0-rc, 10.8.1, 10.8.10, 10.8.11, 10.8.2, 10.8.3, 10.8.4, 10.8.5, 10.8.6, 10.8.7, 10.8.8, 10.8.9, 11.0.0, 11.0.0-rc1, 11.0.0-rc2, 11.0.0-rc3, 11.0.0-rc4, 11.0.0-rc5, 11.0.0-rc6, 11.1.0, 11.1.0-rc, 11.2.0, 11.2.0-rc, 11.2.1, 11.2.2, 11.3.0, 11.3.0-rc, 11.3.1, 11.4.0, 11.4.0-rc, 11.4.1, 11.4.2, 11.5.0, 11.5.0-rc, 12.0.0, 12.0.0-rc1, 12.0.0-rc2, 12.0.0-rc3, 12.0.0-rc4, 12.0.0-rc5, 12.0.1, 12.1.0, 12.1.0-rc, 12.1.1, 12.1.2, 12.2.0, 12.2.0-rc, 12.3.0, 12.3.0-rc, 12.3.1, 12.3.10, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 12.3.6, 12.3.7, 12.3.8, 12.3.9, 13.0.0, 13.0.0-rc1, 13.0.0-rc2, 13.0.0-rc3, 13.0.0-rc4, 13.0.0-rc5, 13.0.1, 13.0.2, 13.0.3, 13.1.0, 13.1.0-rc, 13.1.1, 13.10.0, 13.10.0-rc, 13.10.1, 13.11.0, 13.11.0-rc, 13.11.0-rc2, 13.12.0, 13.12.0-rc, 13.12.0-rc2, 13.2.0, 13.2.0-rc, 13.2.1, 13.2.2, 13.3.0, 13.3.0-rc, 13.3.1, 13.3.2, 13.4.0, 13.4.0-rc, 13.4.0-rc2, 13.4.1, 13.5.0, 13.5.0-rc, 13.5.1, 13.5.2, 13.5.3, 13.6.0, 13.6.0-rc, 13.6.0-rc2, 13.7.0, 13.7.0-rc, 13.7.1, 13.7.2, 13.8.0, 13.8.0-rc, 13.8.1, 13.9.0, 13.9.0-rc, 13.9.1, 13.9.2, 13.9.3

Original source record · Cite this exact observation · Complete original publisher JSON