# Umbraco.Cms (NuGet) vulnerabilities Source: https://junglewise.ai/threats/technologies/umbraco-cms Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/umbraco-cms.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 29 vulnerabilities in Umbraco.Cms (NuGet): 0 in the last 7 days and 1 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-69197, was published on 17 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 29 (1 critical, 0 exploited in the wild) ## About Umbraco.Cms (NuGet) An open-source content management system built on the .NET platform. ## Latest Umbraco.Cms (NuGet) vulnerabilities - [CVE-2026-69197: Umbraco Delivery API authorization bypass in content reference expansion](https://junglewise.ai/threats/cve-2026-69197-umbraco-delivery-api-authorization-bypass-in-content-reference) (high, CVSS 4, published 17 Sep 2026) - [CVE-2026-46616: Umbraco CMS open redirect in member Surface Controllers](https://junglewise.ai/threats/cve-2026-46616-umbraco-cms-open-redirect-in-member-surface-controllers) (medium, CVSS 5.4, published 10 Jun 2026) - [CVE-2026-46609: Umbraco CMS HTML injection in Backoffice confirmation dialog](https://junglewise.ai/threats/cve-2026-46609-umbraco-cms-html-injection-in-backoffice-confirmation-dialog) (medium, CVSS 4.6, published 10 Jun 2026) - [CVE-2026-31834: Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks](https://junglewise.ai/threats/cve-2026-31834-umbraco-affected-by-vertical-privilege-escalation-via-missing) (low, CVSS 3.1, published 11 Mar 2026) - [CVE-2026-31833: Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering](https://junglewise.ai/threats/cve-2026-31833-umbraco-has-stored-xss-in-ufm-rendering-pipeline-via-permissive) (low, CVSS 3.1, published 11 Mar 2026) - [CVE-2026-31832: Umbraco Backoffice API Allows Unauthorized Modification of Domain Data](https://junglewise.ai/threats/cve-2026-31832-umbraco-backoffice-api-allows-unauthorized-modification-of-domain) (low, CVSS 3.1, published 11 Mar 2026) - [CVE-2025-67288: Umbraco CMS arbitrary file upload in PDF processing](https://junglewise.ai/threats/cve-2025-67288-umbraco-cms-arbitrary-file-upload-in-pdf-processing) (critical, CVSS 10, published 22 Dec 2025) - [CVE-2025-66625: Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality](https://junglewise.ai/threats/cve-2025-66625-umbraco-vulnerable-to-improper-file-access-and-credential) (medium, CVSS 4.9, published 9 Dec 2025) - [CVE-2025-49147: Umbraco CMS disclosure of configured password requirements](https://junglewise.ai/threats/cve-2025-49147-umbraco-cms-disclosure-of-configured-password-requirements) (low, CVSS 3.1, published 24 Jun 2025) - [CVE-2025-48953: Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads](https://junglewise.ai/threats/cve-2025-48953-umbraco-vulnerable-to-by-pass-of-configured-allowed-extensions) (low, CVSS 3.1, published 4 Jun 2025) - [CVE-2025-46736: Umbraco Makes User Enumeration Feasible Based on Timing of Login Response](https://junglewise.ai/threats/cve-2025-46736-umbraco-makes-user-enumeration-feasible-based-on-timing-of-login) (low, CVSS 3.1, published 6 May 2025) - [CVE-2025-32017: Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users](https://junglewise.ai/threats/cve-2025-32017-umbraco-has-a-management-api-vulnerability-to-path-traversal-with) (low, CVSS 3.1, published 9 Apr 2025) - [CVE-2024-10761: XSS/HTML Injection Vulnerability in Umbraco Preview Badge](https://junglewise.ai/threats/cve-2024-10761-xss-html-injection-vulnerability-in-umbraco-preview-badge) (low, CVSS 3.1, published 21 Jan 2025) - [CVE-2025-24011: Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes](https://junglewise.ai/threats/cve-2025-24011-umbraco-allows-user-enumeration-feasible-based-on-management-api) (low, CVSS 3.1, published 21 Jan 2025) - [CVE-2024-48929: Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out](https://junglewise.ai/threats/cve-2024-48929-umbraco-cms-has-incomplete-server-termination-during-explicit) (low, CVSS 3.1, published 22 Oct 2024) - [CVE-2024-48927: Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice](https://junglewise.ai/threats/cve-2024-48927-umbraco-has-a-potential-code-execution-risk-when-viewing-svg) (low, CVSS 3.1, published 22 Oct 2024) - [CVE-2024-48926: Umbraco CMS logout page displayed before session expiration](https://junglewise.ai/threats/cve-2024-48926-umbraco-cms-logout-page-displayed-before-session-expiration) (low, CVSS 3.1, published 22 Oct 2024) - [CVE-2024-48925: Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API](https://junglewise.ai/threats/cve-2024-48925-umbraco-cms-improper-access-control-vulnerability-allows-low) (low, CVSS 3.1, published 22 Oct 2024) - [CVE-2024-43377: Umbraco CMS Improper Access Control vulnerability](https://junglewise.ai/threats/cve-2024-43377-umbraco-cms-improper-access-control-vulnerability) (low, CVSS 3.1, published 20 Aug 2024) - [CVE-2023-49279: Stored XSS via SVG File Upload](https://junglewise.ai/threats/cve-2023-49279-stored-xss-via-svg-file-upload) (low, CVSS 3.1, published 13 Dec 2023) - [CVE-2023-49278: Brute force exploit can be used to collect valid usernames](https://junglewise.ai/threats/cve-2023-49278-brute-force-exploit-can-be-used-to-collect-valid-usernames) (low, CVSS 3.1, published 13 Dec 2023) - [CVE-2023-49274: SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email.](https://junglewise.ai/threats/cve-2023-49274-smtp-misconfiguration-leading-to-forgot-password-exploit-that) (low, CVSS 3.1, published 13 Dec 2023) - [CVE-2023-49273: Privilege Escalation using Spoofing](https://junglewise.ai/threats/cve-2023-49273-privilege-escalation-using-spoofing) (low, CVSS 3.1, published 13 Dec 2023) - [CVE-2023-49089: Using the directory back payload (“/../”) in a package name allows placement of package in other folders.](https://junglewise.ai/threats/cve-2023-49089-using-the-directory-back-payload-in-a-package-name-allows) (low, CVSS 3.1, published 13 Dec 2023) - [CVE-2023-48313: DOM-XSS on Backoffice login screen.](https://junglewise.ai/threats/cve-2023-48313-dom-xss-on-backoffice-login-screen) (low, CVSS 3.1, published 13 Dec 2023) ## Most severe Umbraco.Cms (NuGet) vulnerabilities - [CVE-2025-67288: Umbraco CMS arbitrary file upload in PDF processing](https://junglewise.ai/threats/cve-2025-67288-umbraco-cms-arbitrary-file-upload-in-pdf-processing) (critical, CVSS 10, published 22 Dec 2025) - [CVE-2026-69197: Umbraco Delivery API authorization bypass in content reference expansion](https://junglewise.ai/threats/cve-2026-69197-umbraco-delivery-api-authorization-bypass-in-content-reference) (high, CVSS 4, published 17 Sep 2026) - [CVE-2026-46616: Umbraco CMS open redirect in member Surface Controllers](https://junglewise.ai/threats/cve-2026-46616-umbraco-cms-open-redirect-in-member-surface-controllers) (medium, CVSS 5.4, published 10 Jun 2026) - [CVE-2025-66625: Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality](https://junglewise.ai/threats/cve-2025-66625-umbraco-vulnerable-to-improper-file-access-and-credential) (medium, CVSS 4.9, published 9 Dec 2025) - [CVE-2026-46609: Umbraco CMS HTML injection in Backoffice confirmation dialog](https://junglewise.ai/threats/cve-2026-46609-umbraco-cms-html-injection-in-backoffice-confirmation-dialog) (medium, CVSS 4.6, published 10 Jun 2026) - [CVE-2025-24011: Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes](https://junglewise.ai/threats/cve-2025-24011-umbraco-allows-user-enumeration-feasible-based-on-management-api) (low, CVSS 3.1, published 21 Jan 2025) - [CVE-2025-32017: Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users](https://junglewise.ai/threats/cve-2025-32017-umbraco-has-a-management-api-vulnerability-to-path-traversal-with) (low, CVSS 3.1, published 9 Apr 2025) - [CVE-2023-49089: Using the directory back payload (“/../”) in a package name allows placement of package in other folders.](https://junglewise.ai/threats/cve-2023-49089-using-the-directory-back-payload-in-a-package-name-allows) (low, CVSS 3.1, published 13 Dec 2023) - [CVE-2024-10761: XSS/HTML Injection Vulnerability in Umbraco Preview Badge](https://junglewise.ai/threats/cve-2024-10761-xss-html-injection-vulnerability-in-umbraco-preview-badge) (low, CVSS 3.1, published 21 Jan 2025) - [CVE-2023-49278: Brute force exploit can be used to collect valid usernames](https://junglewise.ai/threats/cve-2023-49278-brute-force-exploit-can-be-used-to-collect-valid-usernames) (low, CVSS 3.1, published 13 Dec 2023) ## Vulnerabilities per week Nothing in the last four weeks, down from 1 vulnerability in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other NuGet technologies - [Microsoft.ChakraCore (NuGet)](https://junglewise.ai/threats/technologies/microsoft-chakracore): 247 vulnerabilities - [Magick.NET-Q16-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-anycpu): 167 vulnerabilities - [Magick.NET-Q16-HDRI-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-anycpu): 162 vulnerabilities - [Magick.NET-Q8-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-anycpu): 162 vulnerabilities - [Magick.NET-Q16-HDRI-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x86): 160 vulnerabilities - [Magick.NET-Q8-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-x86): 160 vulnerabilities - [Magick.NET-Q16-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-x86): 159 vulnerabilities - [Magick.NET-Q16-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-arm64): 157 vulnerabilities - [Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-openmp-arm64): 157 vulnerabilities - [Magick.NET-Q16-HDRI-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x64): 157 vulnerabilities - [Magick.NET-Q16-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-arm64): 157 vulnerabilities - [Magick.NET-Q16-OpenMP-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-x64): 157 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Umbraco.Cms (NuGet) vulnerabilities", https://junglewise.ai/threats/technologies/umbraco-cms, 9 November 2026.