March 2025: the Umbraco patch you could not apply where you stood

· JD + AI · Umbraco

March 2025: the Umbraco patch you could not apply where you stood

On 11 March Umbraco patched two moderate-severity issues in the CMS and one high-severity issue in ImageSharp, which it ships as a dependency. The fix came with a condition that matters more than either vulnerability: "Sites will need to update to the latest minor version before the patch can be applied", in the words of the advisory, written by Andy Butland on Umbraco's official blog. If you were two minors behind that day, your security response began with an upgrade project.

Everything else the month produced reads differently once you accept that sentence.

What the advisory actually covered

Affected ranges were 10.0.0–10.8.8, 13.0.0–13.7.0, 14.0.0–14.3.2 and 15.0.0–15.2.2, patched in 10.8.9, 13.7.1, 14.3.3 and 15.2.3 respectively. The two CMS issues are improper API access control around data types, and a restricted editor being able to delete media or reach content they should not; both have GitHub advisories linked from the post. The dependency issue is CVE-2025-27598 in ImageSharp, rated high.

Umbraco rates the whole thing moderate, and its reasoning is sound: every one of these needs an authenticated backoffice session first, so "an attacker must first log in to the backoffice to exploit them". That is real mitigation. It is also, in practice, the sentence that let a lot of teams file this under next sprint.

Umbraco Cloud projects on the latest minor were patched automatically the same day. Projects that were not got the same instruction as everyone else: move the minor first.

One process note, since we are writing this eleven months late. A security advisory is out-of-band work and should have gone out the day it landed as a single-item post. It appears here as a monthly line item because we backfilled March 2025 from feed archives, which is a defect in our coverage, not in the advisory.

Which is why the rest of the month was about moving between versions

This Umbraco 8 to 13 Upgrade Was Easier Than I Expected! — Corné Hoskam The useful part of this post is not the headline, it is the mechanism. Hoskam exported the whole V8 site with Umbraco Deploy, stood up a blank V13 Cloud project, registered Deploy's Artifact Migrators, and imported. That is what converts Nested Content into block lists and drags media pickers to the new format without hand-writing a migration. He reports jumping "directly from V8 to V13" with no intermediate major, which is the claim worth testing on your own content model before you plan around it. Hoskam also says Umbraco 8 reached end of life the month before; that is a lifecycle date from a community source, so confirm it against Umbraco's own support table before you put it in a client deck.

He is equally clear about what the tooling does not do. Content and schema came across in minutes. The .NET Framework to .NET Core rewrite did not, and he says there is no easy path for it. Anyone selling a V8 exit as a content migration is quoting half the job.

KevinJump/uSync v15.1.5. March patchness., and KevinJump/uSync v13.2.7 - Flat white 🍵 — Kevin Jump Two patch releases in one month across two supported majors, which is a fair picture of what the field actually looks like. The v15 release exists because "v15.1.4 - contained a regression bug and was withdrawn" — blank list views stopped content loading. If you update fast, you were the test.

The v13 release is the one to read alongside the advisory. Among its fixes is a workaround for dictionary caching in Umbraco 13.7.x, and 13.7.1 is exactly where the security patch sends every 13.x site. Take the patch, and your imported translations may come back flat instead of nested. Take 13.2.7 with it.

The backoffice bug worth reading end to end

Contributing to Umbraco CMS by fixing a bug — Nathaniel Nunes Nunes writes from ClerksWell, an Umbraco Platinum Partner, and says so in the post. He picks an up-for-grabs accessibility issue, runs Umbraco.Web.UI.Client on its own with mocked services, reproduces the fault in Firefox, and finds that the Save and Publish split menu never showed a focus highlight because "the popover was using overflow:clip". The fix is one CSS declaration.

The fix is not the point. The loop is: which project to run, how to run the backoffice without a .NET backend behind it, and where in the issue tracker the maintainers have already said yes. That is the part most teams have never done, and it is a short afternoon.

What the vendor published the rest of the month

Three of the eight items in this roundup come from umbraco.com. That is 38% of the month from the company that sells the product, and it is worth naming rather than letting the byline variety imply otherwise.

How to Make Personalization Actually Work — Leon de Wildt, Umbraco Personas, content scoring from 1 to 10 per persona, then segment reporting to check the scoring was right. The method is sensible and the post is a product piece for Umbraco Engage, written by Umbraco about Umbraco's own add-on. Read it if you already own Engage. It will not help you decide whether to buy it.

uProfile March 2025 - Karl Tynan — Karl Tynan, Umbraco A community profile of Rock Solid Knowledge's Head of User Experience, an Umbraco MVP and umBristol organiser. Good of its kind, and not news.

Microsoft AI Tour Recap — Dennis Adolfi 114 words and a set of event photographs from Microsoft AI Tour Stockholm, with no Umbraco content in it. It is in this list because our harvest follows Adolfi's blog and March was thin enough that it surfaced. Saying so is better than writing a paragraph that pretends otherwise.

What March was telling you

Eight items across a whole month, and thinner still because we reached it through feed archives rather than live. Do not read the count as ecosystem health.

Read the condition instead. When the patch for a high-severity dependency CVE is only available on the latest minor, minor-version currency stops being maintenance hygiene and becomes a security control. Your time to patch is your time to minor-upgrade, whatever that number is on your slowest client. Most teams have never measured it, and they have therefore committed to a security SLA without knowing what they agreed to.

The honest counterweight is in the same month's uSync releases. Two patches, one of them cleaning up a release that had to be withdrawn. Staying current is work, and the work has its own defects. That is an argument for measuring the upgrade path, not for pretending it is free.

Sources

umbraco · umbraco-cms · umbraco-cloud · product · community · release · deployment · how-to

2026 © Umbracolombia - All rights reserved.