CVE-2023-49089

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-49089
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49089.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-49089
Aliases
Published
2023-12-12T19:02:33.259Z
Modified
2026-04-10T05:04:57.325474Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
Umbraco CMS possible path traversal when creating packages from backoffice
Details

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49089.json"
}
References

Affected packages

Git / github.com/umbraco/umbraco-cms

Affected ranges

Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
b8db430615d76521a4394a23f9928dc7c12f87bd
Fixed
365621023a2e12975104de36e1cbec0829d82804
Database specific 
{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.18.10"
        }
    ]
}
Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
4f06c1f33a54daf4752a439778626202960db68c
Fixed
4a7ad4a562e7f07641d4a33cd246509f4ab59cd8
Database specific 
{
    "versions": [
        {
            "introduced": "9.0.0-rc001"
        },
        {
            "fixed": "10.8.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
38712dce16aa9412af3d81d4884bfc6e5533e019
Fixed
5dfa76600a9bd673888ff7f2a6ac5c87297cb981
Database specific 
{
    "versions": [
        {
            "introduced": "11.0.0-rc1"
        },
        {
            "fixed": "12.3.4"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49089.json"