CVE-2025-67288: 
C# vulnerability analysis and mitigation

CVE-2025-67288 is an arbitrary file upload vulnerability (CWE-434) in Umbraco CMS v16.3.3 that allows attackers to upload crafted PDF files containing embedded JavaScript, resulting in Stored Cross-Site Scripting (XSS) execution in victims' browsers. The vulnerability was published on December 22, 2025, and is disputed by Umbraco, which maintains that file upload validation is the responsibility of the system administrator implementing the CMS, not the CMS itself — a position consistent with their stance on the related CVE-2023-49279. The GitHub Advisory Database rates this as Moderate severity with a CVSS v4 score of 5.8, while the Feedly intelligence data assigns a CVSS v3.1 score of 10.0 (Critical) — the discrepancy reflects the disputed nature and the requirement for user interaction to trigger the XSS (GitHub Advisory, Researcher PoC).

The root cause is that Umbraco CMS does not implement default file content filtering or sanitization for uploaded media files (CWE-434, CWE-79). While Umbraco provides hooks for administrators to implement server-side file validation, these are not enabled by default, meaning PDF files containing embedded JavaScript can be uploaded through the Media section without restriction. When a victim (e.g., an administrator or authenticated user) opens the uploaded PDF via the Umbraco-generated media URL, the browser renders and executes the embedded JavaScript, resulting in a Stored XSS condition. Exploitation requires an attacker to have an account with media upload permissions, and a victim must click the PDF link — meaning this is not a fully unauthenticated, zero-interaction attack as the CVSS v3.1 score of 10.0 might suggest (GitHub Advisory, Researcher PoC).

Successful exploitation results in Stored XSS, enabling arbitrary JavaScript execution in the context of any victim's browser who accesses the malicious PDF link within the Umbraco interface. Potential consequences include session hijacking, credential theft, unauthorized actions performed on behalf of the victim (including administrative actions if an admin is targeted), and exposure of sensitive information accessible within the CMS. While the vulnerability does not directly enable server-side remote code execution, targeting an administrator could allow an attacker to escalate privileges or pivot to further compromise the underlying system (Researcher PoC, GitHub Advisory).

A proof-of-concept (PoC) PDF file (success_xss.pdf) has been publicly released by the researcher alongside the CVE disclosure, demonstrating the XSS trigger via the Umbraco Media upload feature (Researcher PoC). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.059% (19th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Obtain upload access: Log in to Umbraco CMS with an account that has permission to upload media files (e.g., a standard editor or contributor account).
2. Craft malicious PDF: Create a PDF file containing embedded JavaScript (e.g., an alert or cookie-stealing payload). The researcher's PoC (success_xss.pdf) demonstrates this technique.
3. Upload via Media section: Navigate to the Media section in the Umbraco back-office and upload the crafted PDF file.
4. Retrieve the media URL: After upload, Umbraco generates a direct-access URL for the uploaded file.
5. Deliver the link to a victim: Send or share the Umbraco-generated PDF URL to a target user (e.g., an administrator) via internal messaging, email, or by embedding it in CMS content.
6. Trigger XSS: When the victim opens the PDF link in their browser through the Umbraco interface, the embedded JavaScript executes in their browser context, enabling session hijacking, credential theft, or other malicious actions (Researcher PoC).

• File System: Presence of PDF files in the Umbraco media library with unusually small file sizes or unexpected content; files named with generic or obfuscated names (e.g., success_xss.pdf).
• Logs: Umbraco access logs showing uploads of .pdf files to the Media section by non-administrative accounts; repeated access to specific media URLs by multiple different user sessions.
• Network: Browser-initiated outbound requests to attacker-controlled domains originating from Umbraco back-office sessions (indicative of XSS payload execution, e.g., cookie exfiltration endpoints).
• Application: Unexpected session tokens appearing in external logs or attacker infrastructure; admin accounts performing unusual actions (e.g., new user creation, permission changes) shortly after accessing a media PDF link (Researcher PoC).

Umbraco disputes this as a product vulnerability and states that file upload validation is the administrator's responsibility; no official patch has been released specifically for this issue, and the GitHub Advisory lists no patched version (GitHub Advisory). Administrators should implement server-side file validation using Umbraco's provided hooks, as documented in the Umbraco security documentation. Additional mitigations include: restricting media upload permissions to trusted users only, configuring the web server to serve PDF files with Content-Disposition: attachment headers to prevent inline browser rendering, deploying a Web Application Firewall (WAF) to inspect uploaded file content, and auditing existing media libraries for suspicious PDF files.

The vulnerability received coverage from The Hacker Wire, which described it as a "zero-day threat" with critical RCE potential, though this characterization overstates the actual impact (which is Stored XSS, not server-side RCE) (The Hacker Wire). Umbraco formally disputed the CVE, arguing that the behavior is by design and that file validation responsibility lies with implementers, not the CMS — a position reflected in the GitHub Advisory's "Moderate" severity rating versus the initial CVSS 10.0 assigned by NVD (GitHub Advisory). Community discussion on Mastodon and Bluesky noted the discrepancy between the critical CVSS score and the actual attack requirements, with some researchers questioning the validity of the CVE given Umbraco's documented design philosophy.