CVE-2023-49089

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
umbraco	Umbraco-CMS	>= 8.0.0, < 8.18.10; >= 9.0.0-rc001, < 10.8.1; >= 11.0.0-rc1, < 12.3.4

References

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6324-52pr-h4p5Third Party Advisory
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6324-52pr-h4p5Third Party Advisory

Timeline

Published: Dec 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-49094.3Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via CVE-2023-490906.1CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass CVE-2023-490919.8Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Co CVE-2023-490925.9RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key i CVE-2023-490938.8HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker CVE-2023-490944.3Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator CVE-2023-490957.5nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate an CVE-2023-490968.8Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the Videos CVE-2023-490978.8ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to buil CVE-2023-490983.5Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exp CVE-2023-490994.3Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accesse CVE-2023-49105.5A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, t