Read the docs
TI-2012-05477 Aliases CVE-2012-10054GHSA-c8gg-qc8v-6jfx

Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE

Priority HIGH 81CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.04347 91st percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA and NVD
Fix Fixed CMS (Umbraco): 4.7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
umbracoCMSbefore 4.7.14.7.1Patch availableCNA
  • CMS Vendorumbraco Affected before 4.7.1 Fixed in 4.7.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*before 4.7.1Vulnerableumbraco
  • cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:* Versions before 4.7.1 Vulnerable ·umbraco

Remediation

  • Fix · CNA CMS (Umbraco) Fixed in 4.7.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-10054
  2. 2026-10-03 Alias added: GHSA-c8gg-qc8v-6jfx
  3. 2026-10-04 EPSS moved to the 90th–95th percentile

References

Exploit 3

Patch 1

Other 1

  • TI-2025-41183 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute… CVSS 3.1CRITICAL 10.0
  • TI-2021-22392 Umbraco v8.14.1 - 'baseUrl' SSRF CVSS 4.0MEDIUM 6.9
  • TI-2024-36846 A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers… CVSS 3.1MEDIUM 6.5
  • TI-2019-15240 Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by… CVSS 3.1HIGH 7.2
  • TI-2020-04738 Cross-site scripting in Umbraco CMS CVSS 3.1MEDIUM 5.4
  • TI-2012-01170 The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on… CVSS 3.1CRITICAL 9.8
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences