CVE-2023-49089 Umbraco CMS possible path traversal when creating packages from backoffice

High 7.7 Published 12 Dec 2023 Updated 2 Aug 2024

Authenticated backoffice users with package creation permissions can exploit path traversal to write files outside the intended directory.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-49089?

CVE-2023-49089 is a high-severity path traversal vulnerability in Umbraco Umbraco Cms, published on 12 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue.

Weakness: CWE-22

Which versions are affected by CVE-2023-49089?

6 open source packages ship an affected version, including Umbraco.CMS. It affects 1 product.

Package	Affected	Fixed in
`Umbraco.CMS` NuGet	From `11.0.0`	`12.3.4`
`Umbraco.CMS` NuGet	From `11.0.0`	`12.3.4`
`Umbraco.CMS` NuGet	From `8.0.0`	`8.18.10`
`Umbraco.CMS` NuGet	From `8.0.0`	`8.18.10`
`Umbraco.CMS` NuGet	From `9.0.0`	`10.8.1`
`Umbraco.CMS` NuGet	From `9.0.0`	`10.8.1`

Products include Umbraco Umbraco Cms.

How do I fix CVE-2023-49089?

Upgrade Umbraco.CMS to a fixed version for your release line: 12.3.4, 8.18.10 or 10.8.1.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-49089 being exploited?

There is no known exploitation of CVE-2023-49089 in the wild and no public exploit code.

All Umbraco Umbraco Cms vulnerabilities

Sources

Also known as GHSA-6324-52pr-h4p5.