CVE-2019-25137 Code injection in n/a
Authenticated administrators can execute arbitrary code via XSLT script injection in Umbraco CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25137?
CVE-2019-25137 is a high-severity code injection vulnerability in Umbraco Umbraco Cms, published on 18 May 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx.
Weakness: CWE-91
Which versions are affected by CVE-2019-25137?
It affects 1 product.
Products include Umbraco Umbraco Cms.
How do I fix CVE-2019-25137?
No fix has been published for CVE-2019-25137 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-25137 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25137 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Umbraco Umbraco Cms
- CVE-2025-67288 Umbraco CMS has an arbitrary file upload vulnerability
- CVE-2014-10074 File upload in n/a
- CVE-2012-1301 Server-side request forgery in n/a
- CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
- CVE-2025-32017 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
Sources
Also known as GHSA-m3p3-xhrf-jxm7.