What is GHSA-fr6r-p8hv-x3c4?

GHSA-fr6r-p8hv-x3c4 is a security advisory published by GitHub Security Advisories with Medium severity. Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Which CVE IDs does GHSA-fr6r-p8hv-x3c4 cover?

GHSA-fr6r-p8hv-x3c4 covers the following CVE IDs: CVE-2025-48953. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fr6r-p8hv-x3c4?

GHSA-fr6r-p8hv-x3c4 has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

Which products are affected by GHSA-fr6r-p8hv-x3c4?

GHSA-fr6r-p8hv-x3c4 affects 1 product, including: nuget/Umbraco.Cms:\u003e= 14.0.0, \u003c= 15.4.1.

GHSA-fr6r-p8hv-x3c4MediumCVSS 5.5

Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Vendor

GitHub Security Advisories

Published

June 4, 2025

Last Modified

June 4, 2025

🔗 CVE IDs covered (1)

CVE-2025-48953 →

📋 Description

Impact

Via a manipulated API request it's possible to upload a file that doesn't adhere with the configured allowable file extensions.

Patches

Patched in 15.4.2 and 16.0.0.

Workarounds

None available.

🎯 Affected products1

nuget/Umbraco.Cms:>= 14.0.0, <= 15.4.1

🔗 References (4)

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fr6r-p8hv-x3c4
https://nvd.nist.gov/vuln/detail/CVE-2025-48953
https://github.com/umbraco/Umbraco-CMS/commit/d920e93d1ee29dc3301697e444f53e8cd5db3cf9
https://github.com/advisories/GHSA-fr6r-p8hv-x3c4