CVE-2025-22389
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types, including .docm .html. When accessed by application users, these files can be used to execute malicious actions or compromise users' systems.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceOptimizely EPiServer.CMS.Core before version 12.32.0 lacks proper file type validation during upload, allowing dangerous file extensions such as .docm and .html to be stored on the server. When users access these uploaded files, embedded scripts or macros can execute malicious actions or compromise user systems.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 12.32.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed EPiServer.CMS.Core versionLocate the EPiServer.CMS.Core assembly (typically in the /bin folder or as a NuGet package reference) and check its version property, or access the Optimizely admin panel under 'System Information' or 'About' to view the installed CMS Core version.Affected if The installed version is lower than 12.32.0
-
Verify upload functionality is accessibleConfirm that the content authoring interface (Edit mode) is accessible and that the file/upload feature is enabled for content editors. Check user roles and permissions to determine if any user can access the asset/upload functionality.Affected if Users with content editing permissions can access the file upload feature in the CMS
-
Check file type validation configurationReview the web.config or appsettings.json for any custom file type restrictions. Look for keys related to 'allowedFileExtensions', 'uploadWhitelist', or 'episerver:UploadFileTypes' in the configuration files.Affected if There are no restrictive file type validations configured, or dangerous extensions (.docm, .html, .htm, .exe, .bat, .cmd) are explicitly permitted
You are affected if the installed EPiServer.CMS.Core version is below 12.32.0 and the CMS upload functionality is accessible to users without additional compensating controls on allowed file types.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped12.32.0
Upgrade to EPiServer.CMS.Core version 12.32.0 or later which implements proper file validation. Additionally, configure the CMS to whitelist only permitted file types and consider implementing content-based file scanning.
12.32.0
- Backup your Optimizely CMS database and application files before proceeding with the upgrade
- Upgrade Optimizely CMS to version 12.32.0 or later by updating the EPiServer.CMS.Core package in your solution
- Run any database migration scripts if required during the upgrade process
- Verify the upgrade completed successfully by checking the CMS version in the admin interface
- Test file upload functionality to confirm the vulnerability is remediated - ensure .docm and .html files are now properly validated or blocked
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-22389 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-22389 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data