Executive brief
Umbraco CMS is a popular open-source content management system used by organizations to build and manage websites. An authenticated user with backoffice access can inject malicious scripts into localized components, potentially allowing them to steal session tokens, modify content, or perform actions on behalf of administrators viewing those components.
Technical details
This is a cross-site scripting (XSS) vulnerability (CWE-79) in Umbraco's backoffice localization components where user input is not properly sanitized before rendering. The vulnerability requires an authenticated backoffice user and user interaction (the victim must view the affected component), but can be exploited over the network. An attacker with valid credentials can inject malicious HTML or JavaScript into localized text fields, which executes in the browser of any administrator or user viewing that content. Patches are available in versions 14.3.2 and 15.1.2.
Affected products
- Umbraco CMS 14.0.0–14.3.1, 15.0.0–15.1.1
Timeline
- 2025-01-21: disclosed: GHSA-wv8v-rmw2-25wc published
- 2025-01: patched: Patched in versions 14.3.2 and 15.1.2