{"action":"Upgrade Umbraco.Cms to 15.4.2 or later.","affected":[{"fixed":"15.4.2","introduced":"14.0.0"}],"component":"Umbraco.Cms","cve_ids":["CVE-2025-48953"],"ecosystem":"NuGet","epss":0.00185,"exploited":false,"fixed_versions":["15.4.2"],"ghsa_id":"GHSA-fr6r-p8hv-x3c4","id":"tcs_01M5N8N10JF340CF2F9YWMPE14","modified_at":"2025-06-05T00:08:18.494673Z","published_at":"2025-06-04T23:50:55Z","references":["https://osv.dev/vulnerability/GHSA-fr6r-p8hv-x3c4","https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fr6r-p8hv-x3c4","https://nvd.nist.gov/vuln/detail/CVE-2025-48953","https://github.com/umbraco/Umbraco-CMS/commit/d920e93d1ee29dc3301697e444f53e8cd5db3cf9","https://github.com/umbraco/Umbraco-CMS"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-fr6r-p8hv-x3c4","url":"https://osv.dev/vulnerability/GHSA-fr6r-p8hv-x3c4"}],"summary":"Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads"}