Executive brief
Umbraco, a popular content management system, contains a security flaw where authenticated users can inject malicious code into certain input fields. This code is then displayed to other users in confirmation dialogs, potentially allowing an attacker to perform unauthorized actions or steal session information. The issue affects versions 14.0.0 through 17.3.5 and has been resolved in version 17.4.0.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Umbraco CMS versions 14.0.0 to 17.3.5. The flaw is located in the Backoffice confirmation dialog, where user-supplied input is rendered without adequate output encoding (CWE-79). An authenticated attacker with low privileges can inject malicious HTML/JavaScript into an input field. When another user (typically an administrator) interacts with the affected confirmation dialog, the payload executes in their browser context. This could lead to session hijacking or unauthorized administrative actions. The vulnerability is patched in version 17.4.0.
Affected products
- Umbraco Umbraco CMS >= 14.0.0, < 17.4.0
Timeline
- 2026-05-15: advisory: Initial GitHub security advisory published
- 2026-06-10: disclosed: CVE published to NVD
- 2026-06-10: patched: Patch released in version 17.4.0