Cross-site scripting in Umbraco CMS - #VU158824
Published: November 3, 2026
Vulnerability identifier: #VU158824
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute stored scripts in another back-office user's browser context, potentially reading or changing content and configuration accessible to that user.
The vulnerability exists due to improper neutralization of stored media file information in the Umbraco CMS back-office when displaying media items. A remote user can save malicious file information using an account with permission to update media and induce another back-office user to interact with the affected item to execute scripts with that user's privileges.
Affected software
Umbraco CMS
Remediation
Install security update from vendor's website.
Umbraco CMS - addressed in versions 17.7.2, 18.2.2