CVE-2012-10054 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in Umbraco CMS before 4.7.1. The codeEditorSave.asmx SOAP endpoint accepts file writes without a login and has a path traversal weakness, so ASPX scripts can land in a web-accessible folder. Upgrade to 4.7.1 or later.
What's affected
Umbraco CMS versions prior to 4.7.1, per the record and the VulnCheck advisory. The fixed version is 4.7.1.
The record names the codeEditorSave.asmx SOAP endpoint and its SaveDLRScript operation. It says the operation allows arbitrary file uploads without authentication, and that a path traversal flaw in the fileName parameter lets files be written into the web-accessible umbraco directory.
Umbraco 4.x is a very old line. If you still run it, the right target is a modern supported release, not just 4.7.1. A site that old will carry other known issues too.
How to check if you're exposed
Find your Umbraco version in the back office or in your deployment records. Anything below 4.7.1 is in scope.
Then check whether the vulnerable service exists on your server. Look in the web root for the file named in the record:
find /path/to/site -iname "codeEditorSave.asmx"
On Windows, search the site folder for the same file name. If it is present on a pre 4.7.1 install, the endpoint is likely live.
Review the umbraco folder for scripts you did not put there, and check web logs for requests to that endpoint from addresses you do not recognise.
If you find the endpoint, also check whether the folder it could write to contains files with dates that do not match your deployments.
What to do now
- Identify every Umbraco site and its version, including staging and forgotten sites.
- Upgrade to 4.7.1 or later. For a 4.x site, plan a move to a supported release.
- Restrict access to the umbraco admin path by network where you can.
- Search the web root for unfamiliar ASPX files and rebuild the site from a clean source if you find any.
- Rotate the database connection string and any secrets stored in configuration.
Why it matters
Two weaknesses combine here: CWE-22 (Path Traversal) and CWE-434 (Unrestricted Upload of File with Dangerous Type). One lets the caller pick where the file goes. The other lets the caller pick what the file is. With no login in front of the endpoint, the server will write executable script content into a folder that the web server then serves.
Admin and editor helper endpoints are a recurring source of this class of bug. They were built for trusted users and were left reachable by everyone. Authentication on every endpoint, a fixed upload destination and an allowlist of file types close the gap.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced.
Try it yourself
A dynamic scan of a running web app is one way to find exposed endpoints like this before someone else does.
Click through it at your own pace, or open it full screen.
Quick check
Which Umbraco version fixes this?
The record says versions prior to 4.7.1 are affected, so 4.7.1 or later. Moving to a supported release is better.
Does the attacker need to log in?
No. The record says the endpoint permits uploads without authentication.
Sources
Last reviewed: 19 October 2026.
