Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affecting umbracocms.core package, versions [8.0.0,8.18.10)
Threat Intelligence
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-UMBRACOCMSCORE-6124624
- published 13 Dec 2023
- disclosed 12 Dec 2023
- credit Unknown
Introduced: 12 Dec 2023
CVE-2023-49089 Open this link in a new tabHow to fix?
Upgrade UmbracoCms.Core to version 8.18.10 or higher.
Overview
UmbracoCms.Core is an ASP.NET CMS.
Affected versions of this package are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') due to insufficient validation of user-supplied input in the package creation functionality. An attacker with permission to create packages can manipulate file paths to write files outside of the intended directory.
References
CVSS Scores
version 3.1