# Umbraco.Cms (NuGet) vulnerabilities 29 known vulnerabilities (1 critical, 4 high, 18 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 18.3.1 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 18.3.1 (Nov 5, 2026), the latest release - Releases: 336 since 9.0.0 (Sep 27, 2021) - Registry: https://www.nuget.org/packages/Umbraco.Cms - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-69197: 12.0.0 to 13.15.0 (13.15.1 is outside it); 14.0.0-rc1 to 17.5.2 (17.5.3 is outside it); 18.0.0 to 18.0.1 (18.0.2 is outside it) - CVE-2026-46609: 14.0.0 to 17.4.0-rc3 (17.4.0 is outside it) - CVE-2026-46616: 9.0.0-rc001 to 13.14.0-rc3 (13.14.0 is outside it); 17.3.0-rc to 17.4.0-rc3 (17.4.0 is outside it) - CVE-2026-31834: 15.3.1 to 16.5.0 (16.5.1 is outside it); 17.0.0 to 17.2.1 (17.2.2 is outside it) - CVE-2026-31833: 16.2.0 to 16.5.0 (16.5.1 is outside it); 17.0.0 to 17.2.1 (17.2.2 is outside it) - CVE-2026-31832: 14.0.0 to 16.5.0 (16.5.1 is outside it); 17.0.0 to 17.2.1 (17.2.2 is outside it) - CVE-2025-67288: 9.0.0-rc001 to 16.3.3 (16.3.4 is outside it) - CVE-2025-66625: 10.0.0 to 13.12.0 (13.12.1 is outside it) - CVE-2025-49147: 10.0.0 to 10.8.10 (10.8.11 is outside it); 13.0.0 to 13.9.1 (13.9.2 is outside it) - CVE-2025-48953: 14.0.0 to 15.4.1 (15.4.2 is outside it) - CVE-2025-46736: 9.0.0-rc001 to 10.8.9 (10.8.10 is outside it); 11.0.0-rc1 to 13.8.0 (13.8.1 is outside it) - CVE-2025-32017: 14.0.0-rc1 to 14.3.3 (14.3.4 is outside it); 15.0.0-rc1 to 15.3.0 (15.3.1 is outside it) - CVE-2025-24011: 14.0.0 to 14.3.1 (14.3.2 is outside it); 15.0.0 to 15.1.1 (15.1.2 is outside it) - CVE-2024-10761: 10.8.7 (10.8.8 is outside it); 11.0.0 to 13.5.2 (13.5.3 is outside it); 14.0.0 to 14.3.1 (14.3.2 is outside it); 15.0.0 to 15.1.1 (15.1.2 is outside it) - CVE-2024-48929: 10.0.0 to 10.8.6 (10.8.7 is outside it); 13.0.0 to 13.5.1 (13.5.2 is outside it) - CVE-2024-48927: 10.0.0 to 10.8.6 (10.8.7 is outside it); 13.0.0 to 13.5.1 (13.5.2 is outside it) - CVE-2024-48926: 10.0.0 to 10.8.6 (10.8.7 is outside it); 13.0.0 to 13.5.1 (13.5.2 is outside it) - CVE-2024-48925: 14.0.0 to 14.3.0-rc (14.3.0 is outside it) - CVE-2024-43377: 14.0.0 to 14.1.1 (14.1.2 is outside it) - CVE-2023-49279: 9.0.0 to 10.7.0-rc (10.7.0 is outside it); 11.0.0 to 11.5.0-rc (11.5.0 is outside it); 12.0.0 to 12.2.0-rc (12.2.0 is outside it) - CVE-2023-49278: 9.0.0 to 10.8.0 (10.8.1 is outside it); 11.0.0 to 12.3.3 (12.3.4 is outside it) - CVE-2023-49274: 9.0.0 to 10.8.0 (10.8.1 is outside it); 11.0.0 to 12.3.3 (12.3.4 is outside it) - CVE-2023-49273: 9.0.0 to 10.8.0 (10.8.1 is outside it); 11.0.0 to 12.3.3 (12.3.4 is outside it) - CVE-2023-49089: 9.0.0 to 10.8.0 (10.8.1 is outside it); 11.0.0 to 12.3.3 (12.3.4 is outside it) - CVE-2023-48313: 10.0.0 to 10.8.0 (10.8.1 is outside it); 11.0.0 to 12.3.3 (12.3.4 is outside it) - CVE-2023-48227: 9.0.0 to 10.8.0-rc (10.8.0 is outside it); 11.0.0 to 12.3.0-rc (12.3.0 is outside it) - CVE-2023-38694: 9.0.0 to 10.7.0-rc (10.7.0 is outside it); 11.0.0 to 12.1.0-rc (12.1.0 is outside it) - CVE-2015-8814: no published release is affected - CVE-2015-8813: no published release is affected ## Advisories (29) ### [CVE-2026-69197](https://cve.now/CVE-2026-69197): Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion - Severity: High 8.7 - Published: Sep 17, 2026 - Affected: from 12.0.0, fixed in 13.15.1; from 14.0.0-rc1, fixed in 17.5.3; from 18.0.0, fixed in 18.0.2. - Fixed in 13.15.1 (released Jul 7, 2026, 72 days before disclosure), 17.5.3 (released Jul 7, 2026, 72 days before disclosure) and 18.0.2 (released Jul 7, 2026, 72 days before disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2026-46609](https://cve.now/CVE-2026-46609): Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog - Severity: Medium 4.6 - Published: Jun 10, 2026 - Affected: from 14.0.0, fixed in 17.4.0. - Fixed in 17.4.0 (released May 14, 2026, 27 days before disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2026-46616](https://cve.now/CVE-2026-46616): Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers - Severity: Medium 5.4 - Published: Jun 10, 2026 - Affected: fixed in 13.14.0; from 17.3.0-rc, fixed in 17.4.0. - Fixed in 13.14.0 (released Apr 30, 2026, 41 days before disclosure) and 17.4.0 (released May 14, 2026, 27 days before disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2026-31834](https://cve.now/CVE-2026-31834): Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks - Severity: High 7.2 - Published: Mar 10, 2026 - Affected: from 15.3.1, fixed in 16.5.1; from 17.0.0, fixed in 17.2.2. - Fixed in 16.5.1 (released Mar 10, 2026, the day of disclosure) and 17.2.2 (released Mar 10, 2026, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2026-31833](https://cve.now/CVE-2026-31833): Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering - Severity: Medium 6.7 - Published: Mar 10, 2026 - Affected: from 16.2.0, fixed in 16.5.1; from 17.0.0, fixed in 17.2.2. - Fixed in 16.5.1 (released Mar 10, 2026, the day of disclosure) and 17.2.2 (released Mar 10, 2026, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2026-31832](https://cve.now/CVE-2026-31832): Umbraco Backoffice API Allows Unauthorized Modification of Domain Data - Severity: Medium 5.4 - Published: Mar 10, 2026 - Affected: from 14.0.0, fixed in 16.5.1; from 17.0.0, fixed in 17.2.2. - Fixed in 16.5.1 (released Mar 10, 2026, the day of disclosure) and 17.2.2 (released Mar 10, 2026, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2025-67288](https://cve.now/CVE-2025-67288): An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. - Severity: Critical 10.0 - Published: Dec 22, 2025 - Affected: through 16.3.3. - Fixed in 16.3.4 (released Oct 29, 2025, 54 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 18.3.1, is not affected. ### [CVE-2025-66625](https://cve.now/CVE-2025-66625): Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality - Severity: Medium 4.9 - Published: Dec 9, 2025 - Affected: from 10.0.0, fixed in 13.12.1. - Fixed in 13.12.1 (released Dec 9, 2025, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2025-49147](https://cve.now/CVE-2025-49147): Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements - Severity: Medium 5.3 - Published: Jun 24, 2025 - Affected: from 10.0.0, fixed in 10.8.11; from 13.0.0, fixed in 13.9.2. - Fixed in 10.8.11 (released Jun 24, 2025, the day of disclosure) and 13.9.2 (released Jun 24, 2025, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2025-48953](https://cve.now/CVE-2025-48953): Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads - Severity: Medium 5.5 - Published: Jun 3, 2025 - Affected: from 14.0.0, fixed in 15.4.2. - Fixed in 15.4.2 (released Jun 3, 2025, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2025-46736](https://cve.now/CVE-2025-46736): Umbraco Makes User Enumeration Feasible Based on Timing of Login Response - Severity: Medium 5.3 - Published: May 6, 2025 - Affected: from 11.0.0-rc1, fixed in 13.8.1; fixed in 10.8.10. - Fixed in 10.8.10 (released May 6, 2025, the day of disclosure) and 13.8.1 (released May 6, 2025, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2025-32017](https://cve.now/CVE-2025-32017): Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users - Severity: High 8.8 - Published: Apr 8, 2025 - Affected: from 14.0.0--preview004, fixed in 14.3.4; from 15.0.0-rc1, fixed in 15.3.1. - Fixed in 14.3.4 (released Apr 8, 2025, the day of disclosure) and 15.3.1 (released Apr 8, 2025, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2025-24011](https://cve.now/CVE-2025-24011): Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes - Severity: Medium 5.3 - Published: Jan 21, 2025 - Affected: from 14.0.0, fixed in 14.3.2; from 15.0.0, fixed in 15.1.2. - Fixed in 14.3.2 (released Jan 21, 2025, the day of disclosure) and 15.1.2 (released Jan 21, 2025, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2024-10761](https://cve.now/CVE-2024-10761): Umbraco CMS Dashboard frame cross site scripting - Severity: Medium 6.9 - Published: Nov 4, 2024 - Affected: from 11.0.0, fixed in 13.5.3; from 14.0.0, fixed in 14.3.2; from 15.0.0, fixed in 15.1.2; from 10.8.7, fixed in 10.8.8. - Fixed in 10.8.8 (released Jan 21, 2025, 78 days after disclosure), 13.5.3 (released Jan 21, 2025, 78 days after disclosure), 14.3.2 (released Jan 21, 2025, 78 days after disclosure) and 1 other version. - The latest release, 18.3.1, is not affected. ### [CVE-2024-48929](https://cve.now/CVE-2024-48929): Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out - Severity: Medium 4.2 - Published: Oct 22, 2024 - Affected: from 13.0.0, fixed in 13.5.2; from 10.0.0, fixed in 10.8.7. - Fixed in 10.8.7 (released Oct 22, 2024, the day of disclosure) and 13.5.2 (released Oct 22, 2024, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2024-48927](https://cve.now/CVE-2024-48927): Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice - Severity: Medium 4.6 - Published: Oct 22, 2024 - Affected: from 10.0.0, fixed in 10.8.7; from 13.0.0, fixed in 13.5.2. - Fixed in 10.8.7 (released Oct 22, 2024, the day of disclosure) and 13.5.2 (released Oct 22, 2024, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2024-48926](https://cve.now/CVE-2024-48926): Umbraco CMS logout page displayed before session expiration - Severity: Medium 4.2 - Published: Oct 22, 2024 - Affected: from 13.0.0, fixed in 13.5.2; from 10.0.0, fixed in 10.8.7. - Fixed in 10.8.7 (released Oct 22, 2024, the day of disclosure) and 13.5.2 (released Oct 22, 2024, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2024-48925](https://cve.now/CVE-2024-48925): Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API - Severity: None 0.0 - Published: Oct 22, 2024 - Affected: from 14.0.0, fixed in 14.3.0. - Fixed in 14.3.0 (released Oct 3, 2024, 19 days before disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2024-43377](https://cve.now/CVE-2024-43377): Umbraco CMS Improper Access Control vulnerability - Severity: Medium 5.4 - Published: Aug 20, 2024 - Affected: from 14.0.0, fixed in 14.1.2. - Fixed in 14.1.2 (released Aug 20, 2024, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2023-49279](https://cve.now/CVE-2023-49279): Umbraco CMS vulnerable to stored XSS via SVG File Upload - Severity: Low 3.7 - Published: Dec 12, 2023 - Affected: from 7.0.0, fixed in 7.15.11; from 8.0.0, fixed in 8.18.9; from 9.0.0, fixed in 10.7.0; from 11.0.0, fixed in 11.5.0; from 12.0.0, fixed in 12.2.0. - Fixed in 10.7.0 (released Sep 7, 2023, 96 days before disclosure, the advisory names 7.15.11, which was never published), 11.5.0 (released Sep 7, 2023, 96 days before disclosure) and 12.2.0 (released Sep 21, 2023, 82 days before disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2023-49278](https://cve.now/CVE-2023-49278): Umbraco CMS brute force exploit can be used to collect valid usernames - Severity: Medium 5.3 - Published: Dec 12, 2023 - Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.8.1; from 11.0.0, fixed in 12.3.4. - Fixed in 10.8.1 (released Dec 12, 2023, the day of disclosure, the advisory names 8.18.10, which was never published) and 12.3.4 (released Dec 12, 2023, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2023-49274](https://cve.now/CVE-2023-49274): Umbraco CMS SMTP misconfiguration exposes potential registered user email - Severity: Low 3.7 - Published: Dec 12, 2023 - Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.8.1; from 11.0.0, fixed in 12.3.4. - Fixed in 10.8.1 (released Dec 12, 2023, the day of disclosure, the advisory names 8.18.10, which was never published) and 12.3.4 (released Dec 12, 2023, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2023-49273](https://cve.now/CVE-2023-49273): Umbraco CMS vulnerable to Privilege Escalation using Spoofing - Severity: Medium 5.4 - Published: Dec 12, 2023 - Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.8.1; from 11.0.0, fixed in 12.3.4. - Fixed in 10.8.1 (released Dec 12, 2023, the day of disclosure, the advisory names 8.18.10, which was never published) and 12.3.4 (released Dec 12, 2023, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2023-49089](https://cve.now/CVE-2023-49089): Umbraco CMS possible path traversal when creating packages from backoffice - Severity: High 7.7 - Published: Dec 12, 2023 - Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.8.1; from 11.0.0, fixed in 12.3.4. - Fixed in 10.8.1 (released Dec 12, 2023, the day of disclosure, the advisory names 8.18.10, which was never published) and 12.3.4 (released Dec 12, 2023, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2023-48313](https://cve.now/CVE-2023-48313): Umbraco contains a DOM-XSS - Severity: Medium 4.3 - Published: Dec 12, 2023 - Affected: from 10.0.0, fixed in 10.8.1; from 11.0.0, fixed in 12.3.4. - Fixed in 10.8.1 (released Dec 12, 2023, the day of disclosure) and 12.3.4 (released Dec 12, 2023, the day of disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2023-48227](https://cve.now/CVE-2023-48227): Umbraco CMS Backoffice User can bypass "Publish" restriction - Severity: Medium 4.3 - Published: Dec 12, 2023 - Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.8.0; from 11.0.0, fixed in 12.3.0. - Fixed in 10.8.0 (released Nov 30, 2023, 12 days before disclosure, the advisory names 8.18.10, which was never published) and 12.3.0 (released Nov 2, 2023, 40 days before disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2023-38694](https://cve.now/CVE-2023-38694): Umbraco CMS vulnerable to possible injection of HTML in an unintended form - Severity: Low 3.5 - Published: Dec 12, 2023 - Affected: from 8.0.0, fixed in 8.18.10; from 9.0.0, fixed in 10.7.0; from 11.0.0, fixed in 12.1.0. - Fixed in 10.7.0 (released Sep 7, 2023, 96 days before disclosure, the advisory names 8.18.10, which was never published) and 12.1.0 (released Aug 10, 2023, 124 days before disclosure). - The latest release, 18.3.1, is not affected. ### [CVE-2015-8814](https://cve.now/CVE-2015-8814): Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF)… - Severity: Unrated - Published: Mar 3, 2017 - Affected: fixed in 7.4.0. - Fixed in 9.0.0 (released Sep 27, 2021, 1669 days after disclosure, the advisory names 7.4.0, which was never published). - The latest release, 18.3.1, is not affected. ### [CVE-2015-8813](https://cve.now/CVE-2015-8813): The Page\_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote… - Severity: Unrated - Published: Mar 3, 2017 - Affected: fixed in 7.4.0. - Fixed in 9.0.0 (released Sep 27, 2021, 1669 days after disclosure, the advisory names 7.4.0, which was never published). - The latest release, 18.3.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/nuget/umbraco.cms Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.