CVE-2020-9472: Unrestricted Upload of File with Dangerous Type in Umbraco CMS
Summary
CVE-2020-9472: Unrestricted Upload of File with Dangerous Type in Umbraco CMS. Affects UmbracoCms versions < 8.5.4. Fixed in 8.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Umbraco CMS is a popular content management system used for building websites and web applications. It provides a user-friendly interface for managing content and offers various features for customization. However, Umbraco CMS version 8.5.3 and below are vulnerable to an unrestricted file upload issue, which can lead to remote code execution. This vulnerability exists in the Install Package functionality, allowing authenticated users to upload files with dangerous types and potentially execute arbitrary code on the server.
Vulnerability Detail
The unrestricted file upload vulnerability in Umbraco CMS 8.5.3 allows authenticated users to upload files with dangerous types, which can be leveraged to execute arbitrary code on the server. An attacker with valid credentials can exploit this vulnerability by uploading a malicious file, such as a PHP script, that can be executed by the server. This can lead to various consequences, including unauthorized access, data breaches, and complete compromise of the affected system.
How To Fix
Latest published version: 8.18.15 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.5.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable the file upload functionality in Umbraco CMS or restrict access to it. This can be done by modifying the configuration or permissions of the affected system. However, this workaround may impact the normal functionality of the CMS, so upgrading to a patched version is strongly recommended.
Conclusion
Umbraco CMS version 8.5.3 and below are vulnerable to an unrestricted file upload issue, which can lead to remote code execution. To mitigate this vulnerability, it is crucial to upgrade to Umbraco CMS version 8.5.4 or above. Additionally, administrators should ensure that only trusted users have access to the file upload functionality and that uploaded files are properly validated and restricted to safe types. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for UmbracoCms →
FAQ
Umbraco CMS is a popular content management system used for building websites and web applications. It provides a user-friendly interface for managing content and offers various features for customization.
The unrestricted file upload vulnerability in Umbraco CMS can lead to remote code execution, allowing attackers to execute arbitrary code on the server. This can result in unauthorized access, data breaches, and complete compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade Umbraco CMS to version 8.5.4 or above. Upgrade instructions can be found in the Umbraco CMS documentation. It is also important to ensure that only trusted users have access to the file upload functionality and that uploaded files are properly validated and restricted to safe types.
As a temporary workaround, administrators can disable the file upload functionality in Umbraco CMS or restrict access to it. However, this workaround may impact the normal functionality of the CMS, so upgrading to a patched version is strongly recommended.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for UmbracoCms.
