Umbraco Cms vulnerabilities

CVE-2025-48953 [MEDIUM] CWE-434 CVE-2025-48953: Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versi Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and 16.0.0. No known workarounds are available.

CVE-2025-66625 [MEDIUM] CWE-200 CVE-2025-66625: Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error responses (HTTP 500 when a file exists, 404 when it does not) allow the

CVE-2026-31832 [MEDIUM] CWE-639 CVE-2026-31832: Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorizat Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks. The issue is caused by insufficient authorization enforcement on the affected API

CVE-2025-54425 [MEDIUM] CWE-200 CVE-2025-54425: Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 throu Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can be restricted from public access where an API key must be provided in a header to authorize the request. It's also possible to configure output caching, such that the delivery API outputs will be cached for a pe

CVE-2024-55488 [MEDIUM] CWE-79 CVE-2024-55488: A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made

CVE-2025-24011 [MEDIUM] CWE-200 CVE-2025-24011: Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and pri Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and 15.1.2 contain a patch. No known workarounds are availabl

CVE-2023-49279 [MEDIUM] CWE-79 CVE-2023-49279: Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versio Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8

CVE-2025-49147 [MEDIUM] CWE-497 CVE-2025-49147: Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0 Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The information available is limited but would perhaps give some add

CVE-2024-10761 [MEDIUM] CWE-79 CVE-2024-10761: A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been class A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit

CVE-2023-49273 [MEDIUM] CWE-863 CVE-2023-49273: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versio Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (Editor, etc.) are able to access some unintended endpoints. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.

CVE-2021-47776 [MEDIUM] CWE-918 CVE-2021-47776: Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to ma Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side re

CVE-2024-34071 [MEDIUM] CWE-601 CVE-2024-34071: Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulner Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1.

CVE-2026-46616 [MEDIUM] CWE-601 CVE-2026-46616: Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in version

CVE-2023-49278 [MEDIUM] CWE-200 CVE-2023-49278: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versio Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can be used to collect valid usernames. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.

CVE-2023-49274 [MEDIUM] CWE-200 CVE-2023-49274: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versio Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.

CVE-2024-28868 [MEDIUM] CWE-204 CVE-2024-28868: Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the nativ Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.

CVE-2025-46736 [MEDIUM] CWE-204 CVE-2025-46736: Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8 Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patched in versions 10.8.10 and 13.8.1. No known workarounds are available.

CVE-2024-48927 [MEDIUM] CWE-74 CVE-2024-48927: Umbraco, a free and open source .NET content management system, has a remote code execution issue in Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Versions 13.5.2, 10.8,7, and 8.18.15 conta

CVE-2023-38694 [MEDIUM] CWE-79 CVE-2023-38694: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versio Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue.

CVE-2024-43376 [MEDIUM] CWE-209 CVE-2024-43376: Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability is fixed in 14.1.2.