From 40d622ac22d8200c177c09fb0195291101038e30 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lars=20Fl=C3=A5gan?= Date: Mon, 26 Oct 2026 23:27:26 +0100 Subject: [PATCH 1/4] Add affected package EPiServer.CMS.UI < 12.32.0 to GHSA-fc9r-7hhq-7wqj --- .../GHSA-fc9r-7hhq-7wqj.json | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json b/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json index f834c36768fa..47e9ea134ecd 100644 --- a/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json +++ b/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json @@ -13,7 +13,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "EPiServer.CMS.UI" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.32.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", From de8180836ec8569fde48c975f585fbab1ccbae22 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lars=20Fl=C3=A5gan?= Date: Mon, 26 Oct 2026 23:30:44 +0100 Subject: [PATCH 2/4] Add Optimizely package reference --- .../2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json b/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json index 47e9ea134ecd..8d0de482dff7 100644 --- a/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json +++ b/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json @@ -42,6 +42,10 @@ { "type": "WEB", "url": "https://support.optimizely.com/hc/en-us/articles/33182404079629-Content-Management-System-CMS-Security-Advisory-CMS-2025-03" + }, + { + "type": "PACKAGE", + "url": "https://nuget.optimizely.com/packages/EPiServer.CMS.UI/" } ], "database_specific": { From 30000a4b1af545945e45417937f62183b19f5a51 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lars=20Fl=C3=A5gan?= Date: Mon, 26 Oct 2026 23:31:04 +0100 Subject: [PATCH 3/4] Mark Optimizely security advisory as ADVISORY reference --- .../2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json b/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json index 8d0de482dff7..9f2fc6c73224 100644 --- a/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json +++ b/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json @@ -40,7 +40,7 @@ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22389" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://support.optimizely.com/hc/en-us/articles/33182404079629-Content-Management-System-CMS-Security-Advisory-CMS-2025-03" }, { From f00153aea53d9a2b3830d20f6188e26c133639d9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lars=20Fl=C3=A5gan?= Date: Tue, 27 Oct 2026 00:29:45 +0100 Subject: [PATCH 4/4] Correct affected package name in details to EPiServer.CMS.UI --- .../2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json b/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json index 9f2fc6c73224..c59a409baa63 100644 --- a/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json +++ b/advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json @@ -6,7 +6,7 @@ "aliases": [ "CVE-2025-22389" ], - "details": "An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types, including .docm .html. When accessed by application users, these files can be used to execute malicious actions or compromise users' systems.", + "details": "An issue was discovered in Optimizely EPiServer.CMS.UI before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types, including .docm .html. When accessed by application users, these files can be used to execute malicious actions or compromise users' systems.", "severity": [ { "type": "CVSS_V3",