CVE-2025-66625: 
C# vulnerability analysis and mitigation

CVE-2025-66625 is a moderate-severity information disclosure vulnerability in Umbraco CMS (ASP.NET) affecting versions 10.0.0 through 13.12.0. Due to unsafe handling and deletion of temporary files during the dictionary upload process, an authenticated backoffice user can enumerate arbitrary files on the server's filesystem and, in certain configurations, trigger exposure of the NTLM hash of the Windows account running the application. The vulnerability was discovered by Tomasz Holeksa at Pentest Limited and disclosed on December 9, 2025. It carries a CVSS v3.1 base score of 4.9 (Medium) (Github Advisory, Umbraco Advisory).

The root cause is insecure temporary file handling (CWE-377) combined with exposure of sensitive information (CWE-200) and files accessible to external parties (CWE-552). In the vulnerable DictionaryController.cs, the ImportDictionary action accepted a user-supplied file parameter containing a full path without restricting it to the expected temporary uploads directory, allowing path traversal to arbitrary filesystem locations. The application's differential HTTP error responses — HTTP 500 when a file exists and HTTP 404 when it does not — create an oracle that enables filesystem enumeration. Additionally, incomplete cleanup of temporary upload files could cause the application to make outbound SMB/UNC requests, leaking the NTLM hash of the service account. The fix (commit 7505efd) enforces that the file parameter contains only a filename (no path separators), extracts the filename with Path.GetFileName(), and constrains file access to the TempFileUploads directory (Umbraco Advisory, Patch Commit).

The direct impact is limited to confidentiality — no file contents can be read or written, and availability and integrity are unaffected. However, the practical risk is significantly higher in self-hosted Windows environments where Umbraco runs under a privileged local or domain account: exposure of the NTLM hash could enable offline password cracking, NTLM relay attacks, lateral movement within the network, and potentially full domain compromise in weakly segmented environments. Umbraco Cloud deployments are at lower risk because they run under low-privilege, isolated Azure App Service worker identities (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. Exploitation requires authenticated access to the Umbraco backoffice with permissions to the "Translations" section, which significantly limits the attack surface. The EPSS score is approximately 0.041% (13th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Gain backoffice access: Obtain valid Umbraco backoffice credentials with access to the "Translations" section, either through credential theft, phishing, or use of a compromised insider account.
2. Initiate a dictionary upload: Use the Translations section to upload a dictionary file, observing the temporary file path pattern used by the application (e.g., within App_Data/TEMP/FileUploads/).
3. Craft path traversal requests: Submit requests to the ImportDictionary endpoint with the file parameter set to arbitrary filesystem paths (e.g., ../../Windows/System32/drivers/etc/hosts) to probe file existence.
4. Enumerate filesystem via HTTP responses: Observe HTTP 500 responses (file exists) versus HTTP 404 responses (file does not exist) to map out sensitive files on the server's filesystem.
5. Trigger NTLM hash capture (Windows only): In configurations susceptible to incomplete temporary file cleanup, craft a file parameter pointing to a UNC path (e.g., \\attacker-controlled-server\share\file) to force the server to authenticate outbound, capturing the NTLM hash of the service account using a tool such as Responder.
6. Leverage captured hash: Use the captured NTLM hash for offline cracking (e.g., with Hashcat) or NTLM relay attacks to authenticate as the service account and move laterally within the network (Umbraco Advisory, Patch Commit).

• Logs: Umbraco backoffice access logs showing repeated requests to the ImportDictionary or Import endpoints with unusual file parameter values containing path separators (.., \, /) or UNC paths; HTTP 500 responses to dictionary import requests where no legitimate upload was initiated.
• Network: Outbound SMB (TCP port 445) or NetBIOS (TCP/UDP port 139) connections from the Umbraco server to external or unexpected internal IP addresses, which may indicate NTLM hash leakage attempts; unexpected authentication attempts from the Umbraco service account to external hosts.
• File System: Presence of unreferenced or orphaned temporary files in the Umbraco App_Data/TEMP/FileUploads/ directory that were not cleaned up after upload operations.
• Windows Event Logs: Event ID 4625 (failed logon) or Event ID 4648 (logon using explicit credentials) from the Umbraco service account to unexpected hosts; NTLM authentication events (Event ID 4776) involving the service account from unusual source addresses.

Upgrade Umbraco CMS to version 13.12.1 or later, which resolves the vulnerability by enforcing strict filename validation and restricting file access to the designated temporary uploads directory (Umbraco Advisory, Patch Commit). As a workaround prior to patching, restrict backoffice access to the "Translations" section to only fully trusted administrators, and implement network-level controls to prevent the Umbraco server from making outbound SMB connections. For self-hosted Windows deployments, run the Umbraco application under a least-privilege service account to minimize the impact of any potential NTLM hash exposure. Regularly audit and clean up temporary files in the Umbraco upload directories.

The vulnerability was reported by Tomasz Holeksa at Pentest Limited and published by Umbraco maintainer AndyButland on December 9, 2025. The advisory notes that while the CVSS base score of 4.9 reflects only the immediate confidentiality impact, the practical risk for self-hosted deployments running under privileged Windows accounts is considerably higher due to the potential for NTLM relay attacks and lateral movement. No significant broader media coverage or notable community debate has been identified beyond the official advisory (Umbraco Advisory).