Umbraco is a widely deployed open-source content management system with a modestly scoped product line centered on its core CMS platform, Forms module, and identity extensibility layer, serving a significant installed base across web publishing and enterprise content scenarios. Vulnerabilities affecting the vendor skew toward serious outcomes, with a meaningful share reaching critical severity, reflecting the platform's role as a web-facing application and its exposure to common CMS attack surfaces. The exposure recurs through weakness classes including cross-site scripting, unrestricted file uploads, sensitive information disclosure, and authorization bypass—patterns typical of web application frameworks where user input handling, access control, and file-management functions are persistent risk areas. Defenders should treat Umbraco updates as priority items for internet-exposed instances and monitor the Forms module closely given its role in user interaction. Current exploitation activity, KEV listing status, and severity breakdown are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Umbraco over time
Signals from CVEs in this vendor scope (70 CVEs).
70 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-10054CRITICAL Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that | Aug 13, 2025 | 9.8 | 47 | NO | YES |
CVE-2020-5810MEDIUM A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which act as a stored XSS pa | Dec 30, 2020 | 5.4 | 47 | NO | NO |
CVE-2025-67288CRITICAL An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier bec | Dec 22, 2025 | 10.0 | 38 | NO | NO |
CVE-2015-8813HIGH The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forger | Mar 3, 2017 | 8.2 | 37 | NO | YES |
CVE-2021-33224CRITICAL File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file. | Feb 24, 2023 | 9.8 | 32 | NO | NO |
CVE-2012-1301CRITICAL The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter. | Apr 13, 2017 | 9.8 | 32 | NO | NO |
CVE-2021-37334CRITICAL Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. | Aug 25, 2021 | 9.8 | 31 | NO | NO |
CVE-2014-10074CRITICAL Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files. | Aug 27, 2018 | 9.8 | 30 | NO | NO |
CVE-2023-37267CRITICAL Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6 | Jul 13, 2023 | 9.8 | 29 | NO | NO |
CVE-2020-5811MEDIUM An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of | Dec 30, 2020 | 6.5 | 29 | NO | YES |
Signals from CVEs in this vendor scope (70 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Umbraco.
Media articles that mention a CVE ID that affects a product developed by Umbraco — matched by CVE ID, not by vendor name.