--- title: "CVE-2023-49089" date: "2024-10-21T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cve-2023-49089/" --- # CVE-2023-49089 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Dec 11, 2023 CVE-2023-49089 **Published:** Oct 21, 2024 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 6.5 Medium Severity package Path-Traversal umbraco MT Mário Teixeira Reported by Checkmarx Zero Details Overview ## Summary The package `@umbraco/Umbraco-CMS` contains a path traversal vulnerability in the `Create Package` functionality. A user with high privileges can input a relative or absolute path as the package name, which results in the creation of a folder and a `packages.xml` file in that location. If the folder already exists, the file can be overwritten. Although this issue requires high privileges, it presents a risk of unintended file modifications. The issue was resolved by sanitizing the package name to prevent path traversal. ## Product This vulnerability affects `@umbraco/Umbraco-CMS` versions: - 8.0.0 through 8.18.9 - 9.0.0 through 10.8.0 - 11.0.0 through 12.3.3 ## Impact The vulnerability allows an authenticated user with the ability to create packages to specify arbitrary paths, resulting in potential overwriting of files outside the intended directory. ## Steps to reproduce 1. Log in with sufficient privileges to create packages in `@umbraco/Umbraco-CMS`. 2. Use the “Create Package” functionality and set the package name to a relative or absolute path, e.g., `../../some/folder`. 3. Upon creation, a `packages.xml` file will be created in the specified directory, and if the directory already exists, the file will be overwritten. ### Expected result: The path traversal allows creating or overwriting files outside the intended directory. ## Remediation The issue was resolved by sanitizing the input for the package name to prevent path traversal attacks. The patched versions ensure that package names cannot include relative or absolute paths. The fix was released in the following versions: - 8.18.10 - 10.8.1 - 12.3.4 ## Credit This issue was discovered and reported by Checkmarx AppSec Analyst [Mário Teixeira](https://www.linkedin.com/in/marioleitao-teixeira/). ## Resources 1. [CVE-2023-49089](https://nvd.nist.gov/vuln/detail/CVE-2023-49089) 2. [GHSA-6324-52pr-h4p5](https://github.com/advisories/GHSA-6324-52pr-h4p5) 3. [Fix Commit](https://github.com/umbraco/Umbraco-CMS/commit/b3caf747df213a3fe92f9249cdb9753210b4b013) 0 Medium Severity CVSS v3.1 Score 6.5 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None Advisory Timeline1. Discovered Sep 20, 2023 2. Disclosed Nov 6, 2023 The vulnerability was privately disclosed to the maintainer 3. Fixed Dec 11, 2023 A commit was released with the vulnerability fix. ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)