Vulnerability in Umbraco 13.13 - When Will the Fix Be Released?

[vineethpa202]

I’ve updated my project with Umbraco 13.13, and it appears that there is still a known vulnerability present in this version. I wanted to bring this to your attention and inquire about the planned release date for the fix.

Could you please provide an update on when we can expect a security patch or an updated version that addresses this issue?

[Luuk (Luuk Peters (Proud Nerds))]

It probably won’t, please read:

CVE-2025-67288 and v13?

Just to walk this CVE back a bit… It’s an attention grabbing PoC Upload a crafted PDF file containing embedded JavaScript. Observe that JavaScript from the PDF executes in the browser. But what does Umbraco have to do with that? You could upload the file anywhere - in fact, you can download the PoC file from GitHub… does that mean GitHub is vulnerable to a CWE-434…? No, and neither is Umbraco. The product allows the upload or transfer of dangerous file types that are automatically process…

[JasonElkin]

I’ve added a bit more detail and an example IFileStreamSecurityAnalyzer for scanning PDFs in an article here:

Mitigating CVE-2025-67288 in Umbraco 13 (if you feel you need to)