Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

Umbraco.Cms

29 known vulnerabilities (1 critical, 4 high, 18 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
18.3.1 (Nov 5, 2026): no advisory affects it
Newest unaffected release
18.3.1 (Nov 5, 2026), the latest release
Advisories
29 · 1 critical, 4 high, 18 medium, 3 low
Releases
336 since 9.0.0 (Sep 27, 2021)
Registry
NuGet
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-69197
    Affects 12.0.0 to 13.15.0 (13.15.1 is outside it); 14.0.0-rc1 to 17.5.2 (17.5.3 is outside it); 18.0.0 to 18.0.1 (18.0.2 is outside it)
  • CVE-2026-46609
    Affects 14.0.0 to 17.4.0-rc3 (17.4.0 is outside it)
  • CVE-2026-46616
    Affects 9.0.0-rc001 to 13.14.0-rc3 (13.14.0 is outside it); 17.3.0-rc to 17.4.0-rc3 (17.4.0 is outside it)
  • CVE-2026-31834
    Affects 15.3.1 to 16.5.0 (16.5.1 is outside it); 17.0.0 to 17.2.1 (17.2.2 is outside it)
  • CVE-2026-31833
    Affects 16.2.0 to 16.5.0 (16.5.1 is outside it); 17.0.0 to 17.2.1 (17.2.2 is outside it)
  • CVE-2026-31832
    Affects 14.0.0 to 16.5.0 (16.5.1 is outside it); 17.0.0 to 17.2.1 (17.2.2 is outside it)
  • CVE-2025-67288
    Affects 9.0.0-rc001 to 16.3.3 (16.3.4 is outside it)
  • CVE-2025-66625
    Affects 10.0.0 to 13.12.0 (13.12.1 is outside it)
  • CVE-2025-49147
    Affects 10.0.0 to 10.8.10 (10.8.11 is outside it); 13.0.0 to 13.9.1 (13.9.2 is outside it)
  • CVE-2025-48953
    Affects 14.0.0 to 15.4.1 (15.4.2 is outside it)
  • CVE-2025-46736
    Affects 9.0.0-rc001 to 10.8.9 (10.8.10 is outside it); 11.0.0-rc1 to 13.8.0 (13.8.1 is outside it)
  • CVE-2025-32017
    Affects 14.0.0-rc1 to 14.3.3 (14.3.4 is outside it); 15.0.0-rc1 to 15.3.0 (15.3.1 is outside it)
Show all 29 advisoriesShow fewer advisories
  • CVE-2025-24011
    Affects 14.0.0 to 14.3.1 (14.3.2 is outside it); 15.0.0 to 15.1.1 (15.1.2 is outside it)
  • CVE-2024-10761
    Affects 10.8.7 (10.8.8 is outside it); 11.0.0 to 13.5.2 (13.5.3 is outside it); 14.0.0 to 14.3.1 (14.3.2 is outside it); 15.0.0 to 15.1.1 (15.1.2 is outside it)
  • CVE-2024-48929
    Affects 10.0.0 to 10.8.6 (10.8.7 is outside it); 13.0.0 to 13.5.1 (13.5.2 is outside it)
  • CVE-2024-48927
    Affects 10.0.0 to 10.8.6 (10.8.7 is outside it); 13.0.0 to 13.5.1 (13.5.2 is outside it)
  • CVE-2024-48926
    Affects 10.0.0 to 10.8.6 (10.8.7 is outside it); 13.0.0 to 13.5.1 (13.5.2 is outside it)
  • CVE-2024-48925
    Affects 14.0.0 to 14.3.0-rc (14.3.0 is outside it)
  • CVE-2024-43377
    Affects 14.0.0 to 14.1.1 (14.1.2 is outside it)
  • CVE-2023-49279
    Affects 9.0.0 to 10.7.0-rc (10.7.0 is outside it); 11.0.0 to 11.5.0-rc (11.5.0 is outside it); 12.0.0 to 12.2.0-rc (12.2.0 is outside it)
  • CVE-2023-49278
    Affects 9.0.0 to 10.8.0 (10.8.1 is outside it); 11.0.0 to 12.3.3 (12.3.4 is outside it)
  • CVE-2023-49274
    Affects 9.0.0 to 10.8.0 (10.8.1 is outside it); 11.0.0 to 12.3.3 (12.3.4 is outside it)
  • CVE-2023-49273
    Affects 9.0.0 to 10.8.0 (10.8.1 is outside it); 11.0.0 to 12.3.3 (12.3.4 is outside it)
  • CVE-2023-49089
    Affects 9.0.0 to 10.8.0 (10.8.1 is outside it); 11.0.0 to 12.3.3 (12.3.4 is outside it)
  • CVE-2023-48313
    Affects 10.0.0 to 10.8.0 (10.8.1 is outside it); 11.0.0 to 12.3.3 (12.3.4 is outside it)
  • CVE-2023-48227
    Affects 9.0.0 to 10.8.0-rc (10.8.0 is outside it); 11.0.0 to 12.3.0-rc (12.3.0 is outside it)
  • CVE-2023-38694
    Affects 9.0.0 to 10.7.0-rc (10.7.0 is outside it); 11.0.0 to 12.1.0-rc (12.1.0 is outside it)
  • CVE-2015-8814
    No published release is affected
    No published release is affected
  • CVE-2015-8813
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 29

  • Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

    Affected: from 12.0.0, fixed in 13.15.1; from 14.0.0-rc1, fixed in 17.5.3; from 18.0.0, fixed in 18.0.2.

    Fixed in 13.15.1 (released Jul 7, 2026, 72 days before disclosure), 17.5.3 (released Jul 7, 2026, 72 days before disclosure) and 18.0.2 (released Jul 7, 2026, 72 days before disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2026-46609Medium 4.6

    Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

    Affected: from 14.0.0, fixed in 17.4.0.

    Fixed in 17.4.0 (released May 14, 2026, 27 days before disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2026-46616Medium 5.4

    Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

    Affected: fixed in 13.14.0; from 17.3.0-rc, fixed in 17.4.0.

    Fixed in 13.14.0 (released Apr 30, 2026, 41 days before disclosure) and 17.4.0 (released May 14, 2026, 27 days before disclosure).

    The latest release, 18.3.1, is not affected.

  • Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

    Affected: from 15.3.1, fixed in 16.5.1; from 17.0.0, fixed in 17.2.2.

    Fixed in 16.5.1 (released Mar 10, 2026, the day of disclosure) and 17.2.2 (released Mar 10, 2026, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2026-31833Medium 6.7

    Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

    Affected: from 16.2.0, fixed in 16.5.1; from 17.0.0, fixed in 17.2.2.

    Fixed in 16.5.1 (released Mar 10, 2026, the day of disclosure) and 17.2.2 (released Mar 10, 2026, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2026-31832Medium 5.4

    Umbraco Backoffice API Allows Unauthorized Modification of Domain Data

    Affected: from 14.0.0, fixed in 16.5.1; from 17.0.0, fixed in 17.2.2.

    Fixed in 16.5.1 (released Mar 10, 2026, the day of disclosure) and 17.2.2 (released Mar 10, 2026, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2025-67288Critical 10.0

    An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file.

    Affected: through 16.3.3.

    Fixed in 16.3.4 (released Oct 29, 2025, 54 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 18.3.1, is not affected.

  • CVE-2025-66625Medium 4.9

    Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality

    Affected: from 10.0.0, fixed in 13.12.1.

    Fixed in 13.12.1 (released Dec 9, 2025, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2025-49147Medium 5.3

    Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements

    Affected: from 10.0.0, fixed in 10.8.11; from 13.0.0, fixed in 13.9.2.

    Fixed in 10.8.11 (released Jun 24, 2025, the day of disclosure) and 13.9.2 (released Jun 24, 2025, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2025-48953Medium 5.5

    Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

    Affected: from 14.0.0, fixed in 15.4.2.

    Fixed in 15.4.2 (released Jun 3, 2025, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2025-46736Medium 5.3

    Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

    Affected: from 11.0.0-rc1, fixed in 13.8.1; fixed in 10.8.10.

    Fixed in 10.8.10 (released May 6, 2025, the day of disclosure) and 13.8.1 (released May 6, 2025, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

    Affected: from 14.0.0--preview004, fixed in 14.3.4; from 15.0.0-rc1, fixed in 15.3.1.

    Fixed in 14.3.4 (released Apr 8, 2025, the day of disclosure) and 15.3.1 (released Apr 8, 2025, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2025-24011Medium 5.3

    Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes

    Affected: from 14.0.0, fixed in 14.3.2; from 15.0.0, fixed in 15.1.2.

    Fixed in 14.3.2 (released Jan 21, 2025, the day of disclosure) and 15.1.2 (released Jan 21, 2025, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2024-10761Medium 6.9

    Umbraco CMS Dashboard frame cross site scripting

    Affected: from 11.0.0, fixed in 13.5.3; from 14.0.0, fixed in 14.3.2; from 15.0.0, fixed in 15.1.2; from 10.8.7, fixed in 10.8.8.

    Fixed in 10.8.8 (released Jan 21, 2025, 78 days after disclosure), 13.5.3 (released Jan 21, 2025, 78 days after disclosure), 14.3.2 (released Jan 21, 2025, 78 days after disclosure) and 1 other version.

    The latest release, 18.3.1, is not affected.

  • CVE-2024-48929Medium 4.2

    Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out

    Affected: from 13.0.0, fixed in 13.5.2; from 10.0.0, fixed in 10.8.7.

    Fixed in 10.8.7 (released Oct 22, 2024, the day of disclosure) and 13.5.2 (released Oct 22, 2024, the day of disclosure).

    The latest release, 18.3.1, is not affected.

Show all 29 advisoriesShow fewer advisories
  • CVE-2024-48927Medium 4.6

    Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

    Affected: from 10.0.0, fixed in 10.8.7; from 13.0.0, fixed in 13.5.2.

    Fixed in 10.8.7 (released Oct 22, 2024, the day of disclosure) and 13.5.2 (released Oct 22, 2024, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2024-48926Medium 4.2

    Umbraco CMS logout page displayed before session expiration

    Affected: from 13.0.0, fixed in 13.5.2; from 10.0.0, fixed in 10.8.7.

    Fixed in 10.8.7 (released Oct 22, 2024, the day of disclosure) and 13.5.2 (released Oct 22, 2024, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API

    Affected: from 14.0.0, fixed in 14.3.0.

    Fixed in 14.3.0 (released Oct 3, 2024, 19 days before disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2024-43377Medium 5.4

    Umbraco CMS Improper Access Control vulnerability

    Affected: from 14.0.0, fixed in 14.1.2.

    Fixed in 14.1.2 (released Aug 20, 2024, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • Umbraco CMS vulnerable to stored XSS via SVG File Upload

    Affected: from 7.0.0, fixed in 7.15.11; from 8.0.0, fixed in 8.18.9; from 9.0.0, fixed in 10.7.0; from 11.0.0, fixed in 11.5.0; from 12.0.0, fixed in 12.2.0.

    Fixed in 10.7.0 (released Sep 7, 2023, 96 days before disclosure, the advisory names 7.15.11, which was never published), 11.5.0 (released Sep 7, 2023, 96 days before disclosure) and 12.2.0 (released Sep 21, 2023, 82 days before disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2023-49278Medium 5.3

    Umbraco CMS brute force exploit can be used to collect valid usernames

    Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.8.1; from 11.0.0, fixed in 12.3.4.

    Fixed in 10.8.1 (released Dec 12, 2023, the day of disclosure, the advisory names 8.18.10, which was never published) and 12.3.4 (released Dec 12, 2023, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • Umbraco CMS SMTP misconfiguration exposes potential registered user email

    Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.8.1; from 11.0.0, fixed in 12.3.4.

    Fixed in 10.8.1 (released Dec 12, 2023, the day of disclosure, the advisory names 8.18.10, which was never published) and 12.3.4 (released Dec 12, 2023, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2023-49273Medium 5.4

    Umbraco CMS vulnerable to Privilege Escalation using Spoofing

    Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.8.1; from 11.0.0, fixed in 12.3.4.

    Fixed in 10.8.1 (released Dec 12, 2023, the day of disclosure, the advisory names 8.18.10, which was never published) and 12.3.4 (released Dec 12, 2023, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • Umbraco CMS possible path traversal when creating packages from backoffice

    Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.8.1; from 11.0.0, fixed in 12.3.4.

    Fixed in 10.8.1 (released Dec 12, 2023, the day of disclosure, the advisory names 8.18.10, which was never published) and 12.3.4 (released Dec 12, 2023, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2023-48313Medium 4.3

    Umbraco contains a DOM-XSS

    Affected: from 10.0.0, fixed in 10.8.1; from 11.0.0, fixed in 12.3.4.

    Fixed in 10.8.1 (released Dec 12, 2023, the day of disclosure) and 12.3.4 (released Dec 12, 2023, the day of disclosure).

    The latest release, 18.3.1, is not affected.

  • CVE-2023-48227Medium 4.3

    Umbraco CMS Backoffice User can bypass "Publish" restriction

    Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.8.0; from 11.0.0, fixed in 12.3.0.

    Fixed in 10.8.0 (released Nov 30, 2023, 12 days before disclosure, the advisory names 8.18.10, which was never published) and 12.3.0 (released Nov 2, 2023, 40 days before disclosure).

    The latest release, 18.3.1, is not affected.

  • Umbraco CMS vulnerable to possible injection of HTML in an unintended form

    Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.7.0; from 11.0.0, fixed in 12.1.0.

    Fixed in 10.7.0 (released Sep 7, 2023, 96 days before disclosure, the advisory names 8.18.10, which was never published) and 12.1.0 (released Aug 10, 2023, 124 days before disclosure).

    The latest release, 18.3.1, is not affected.

  • Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF)…

    Affected: fixed in 7.4.0.

    Fixed in 9.0.0 (released Sep 27, 2021, 1669 days after disclosure, the advisory names 7.4.0, which was never published).

    The latest release, 18.3.1, is not affected.

  • The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote…

    Affected: fixed in 7.4.0.

    Fixed in 9.0.0 (released Sep 27, 2021, 1669 days after disclosure, the advisory names 7.4.0, which was never published).

    The latest release, 18.3.1, is not affected.