GitHub Advisoryadvisory · NuGet

GHSA-h66j-xm43-47pp Umbraco CMS contains a server-side request forgery vulnerability

MEDIUM Published 2026-01-15 Modified 2026-01-15 Official page ↗
Aliases
CVE-2021-47776
Ecosystem
NuGet
Packages
UmbracoCms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-918
Reviewed
2026-01-15

Affected packages

• NuGet UmbracoCms: 8.14.1 (no fix yet)

Description

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side requests to external hosts.

Related

Alias · CVE (1)

  • CVE-2021-47776 Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References