umbraco vulnerabilities

Products

• umbraco cms 56
• Umbraco-CMS 37
• umbraco forms 7
• umbraco 4
• Umbraco.Forms.Issues 4
• CMS 2
• forms 1
• umbraco identity extensibility 1
• Umbraco.Commerce.Issues 1
• Umbraco.Engage.Forms 1
• Umbraco.Workflow.Issues 1
• UmbracoIdentityExtensions 1

Latest umbraco CVEs

Newest publication first · page 1 of 3

1. CVE-2026-111624 Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs

   Published 2026-10-16

   Medium·CVSS 6.3 EPSS 0.31%

   Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications th...

2. CVE-2026-69197 Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

   Published 2026-09-17

   High·CVSS 8.7 EPSS 0.66%

   Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers n...

3. CVE-2026-46609 Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

   Published 2026-06-10

   Medium·CVSS 4.6 EPSS 0.14%

   Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in the confirmation dialog without proper output encoding. This issue has been patched in version 17.4.0.

4. CVE-2026-46616 Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

   Published 2026-06-10

   Medium·CVSS 6.1 EPSS 0.18%

   Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerab...

5. CVE-2026-31834 Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

   Published 2026-03-10

   High·CVSS 7.2 EPSS 0.38%

   Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to in...

6. CVE-2026-31833 Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

   Published 2026-03-10

   Medium·CVSS 6.7 EPSS 0.30%

   Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instanc...

7. CVE-2026-31832 Umbraco Backoffice API Allows Unauthorized Modification of Domain Data

   Published 2026-03-10

   Medium·CVSS 5.4 EPSS 0.21%

   Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks. The issue...

8. CVE-2026-27449 Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints

   Published 2026-02-26

   High·CVSS 7.5 EPSS 0.41%

   Umbraco Engage is a business intelligence platform. A vulnerability has been identified in Umbraco Engage prior to versions 16.2.1 and 17.1.1 where certain API endpoints are exposed without enforcing authentication or authorization checks. The affected endpoints can be accessed d...

9. CVE-2026-24687 Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac

   Published 2026-01-29

   Medium·CVSS 6.0 EPSS 0.46%

   Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms....

10. CVE-2025-68924 UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation

    Published 2026-01-16

    High·CVSS 7.5 EPSS 0.76%

    In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.

11. CVE-2021-47776 Umbraco v8.14.1 - 'baseUrl' SSRF

    Published 2026-01-15

    Medium·CVSS 6.9 EPSS 0.38% Public exploit

    Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and...

12. CVE-2025-67288 Umbraco CMS has an arbitrary file upload vulnerability

    Published 2025-12-22

    Critical·CVSS 10.0 EPSS 0.55% PoC

    An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system ad...

13. CVE-2025-66625 Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality

    Published 2025-12-09

    Medium·CVSS 4.9 EPSS 0.38%

    Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error r...

14. CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE

    Published 2025-08-13

    Critical·CVSS 9.3 EPSS 4.3% Framework module

    Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fi...

15. CVE-2025-54425 Umbraco's Delivery API allows for cached requests to be returned with an invalid API key

    Published 2025-07-30

    Medium·CVSS 5.3 EPSS 0.39%

    Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can be restricted from public access where an API key must be provided in a header to authorize the request. It's also possible to configure out...

16. CVE-2025-49147 Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements

    Published 2025-06-24

    Medium·CVSS 5.3 EPSS 0.34%

    Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirement...

17. CVE-2025-48953 Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

    Published 2025-06-03

    Medium·CVSS 6.5 EPSS 0.19%

    Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versi...

18. CVE-2025-47280 Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow

    Published 2025-05-13

    Low·CVSS 2.3 EPSS 0.30%

    Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2, the 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form...

19. CVE-2025-46736 Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

    Published 2025-05-06

    Medium·CVSS 5.3 EPSS 0.39%

    Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patched in versions 10.8.10 and 13.8.1. No kn...

20. CVE-2025-32017 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

    Published 2025-04-08

    High·CVSS 8.8 EPSS 0.65%

    Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is pat...

21. CVE-2025-27602 Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

    Published 2025-03-11

    Medium·CVSS 6.4 EPSS 0.30%

    Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media...

22. CVE-2025-27601 Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality

    Published 2025-03-11

    Medium·CVSS 4.3 EPSS 0.32%

    Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information...

23. CVE-2025-24012 Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability

    Published 2025-01-21

    Medium·CVSS 5.4 EPSS 0.27%

    Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2...

24. CVE-2025-24011 Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes

    Published 2025-01-21

    Medium·CVSS 5.3 EPSS 1.6%

    Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versio...

25. CVE-2025-23041 Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms

    Published 2025-01-14

    Medium·CVSS 5.3 EPSS 0.39%

    Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.