GitHub Advisoryadvisory · NuGet

GHSA-vr9v-27gg-qgx4 Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

MEDIUM Published 2026-05-21 Modified 2026-06-10 Official page ↗

Aliases: CVE-2026-46609
Ecosystem: NuGet
Packages: Umbraco.Cms
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses: CWE-79
Reviewed: 2026-05-21

Affected packages

• NuGet Umbraco.Cms: >= 14.0.0, < 17.4.0 → fixed in 17.4.0

Description

Impact Authenticated users are able to inject HTML vulnerability into an input field, which is rendered in the confirmation dialog without proper output encoding. Patches This issue has been patched in 17.4.0

Alias · CVE (1)

CVE-2026-46609 Umbraco is an ASP.NET CMS. vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References