CVE-2020-5811: Authenticated Path Traversal in Umbraco CMS
Summary
CVE-2020-5811: Authenticated path traversal in Umbraco CMS. Affects UmbracoCms versions < 8.9.2. Fixed in 8.9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Umbraco CMS is an open-source content management system built on the Microsoft .NET framework. It provides a flexible and customizable platform for creating and managing websites. Umbraco CMS versions up to 8.9.1 or current are affected by an authenticated path traversal vulnerability during package installation. This vulnerability allows an authenticated attacker to write arbitrary files outside of the site home and expected paths when installing an Umbraco package.
Vulnerability Detail
The authenticated path traversal vulnerability in Umbraco CMS allows an attacker with valid credentials to bypass file restrictions and write files to arbitrary locations on the server. By exploiting this vulnerability, an attacker can potentially overwrite critical system files, inject malicious code, or gain unauthorized access to sensitive information. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 8.18.15 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.9.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading Umbraco CMS to the latest version.
Conclusion
The authenticated path traversal vulnerability in Umbraco CMS can be mitigated by upgrading to the latest version. It is crucial to regularly update and patch the CMS to ensure the security of the website. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for UmbracoCms →
FAQ
Umbraco CMS is an open-source content management system built on the Microsoft .NET framework. It provides a flexible and customizable platform for creating and managing websites.
An authenticated path traversal vulnerability allows an attacker with valid credentials to bypass file restrictions and write files to arbitrary locations on the server.
By exploiting this vulnerability, an attacker can potentially overwrite critical system files, inject malicious code, or gain unauthorized access to sensitive information.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade Umbraco CMS to version 8.9.2 or later. Users should follow the upgrade instructions provided by the Umbraco project.
Related vulnerabilities
Recent vulnerabilities recorded for UmbracoCms.
