← Vulnerability feed

Vulnerability record · CVE-2012-10054 · published 13 August 2025

CVE-2012-10054: Umbraco cms path traversal vulnerability

Umbraco · Umbraco Cms

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.

9.3 CVSS 4.0 Critical EPSS 2.8% · top 14.1% CWE-22 · Path traversalCWE-434 · Unrestricted file upload
9.3CVSS 4.0 base score
2.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/umbraco/Umbraco-CMS Product
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/umbraco_upload_aspx.r Exploit
https://web.archive.org/web/20111017174609/http://umbraco.codeplex.com/releases/view/73692 PatchThird Party Advisory
https://web.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-l Patch
https://www.exploit-db.com/exploits/19671 Exploit
https://www.vulncheck.com/advisories/umbraco-cms-rce Third Party Advisory
https://web.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-l Patch

Track CVE-2012-10054 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-67288Umbraco cms unrestricted file upload vulnerabilityAn arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this …EPSS 0.55%9.8CVE-2023-37267Umbraco cms improper access control vulnerabilityUmbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerabili…EPSS 0.72%9.8CVE-2014-10074Umbraco cms unrestricted file upload vulnerabilityUmbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the up…EPSS 2.8%9.8CVE-2012-1301Umbraco cms improper input validation vulnerabilityThe FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter.EPSS 3.5%8.8CVE-2025-32017Umbraco cms relative path traversal vulnerabilityUmbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API requ…EPSS 0.62%8.8CVE-2020-9471Umbraco cms unrestricted file upload vulnerabilityUmbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.EPSS 2.3%8.7CVE-2024-47819Umbraco cms cross-site scripting vulnerabilityUmbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to vers…EPSS 0.33%7.5CVE-2022-22690Umbraco cms http request smuggling vulnerabilityWithin the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to b…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2012-10054), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.