PT-2026-24486 · Umbraco · Umbraco

Odgrso · Published 2026-03-10 · Updated 2026-03-12 · CVE-2026-31833

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Umbraco versions 16.2.0 through 16.5.0 Umbraco version 17.2.2

Description Umbraco is an ASP.NET CMS. An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. The issue stems from an overly permissive attributeNameCheck configuration (/.+/) within the UFM DOMPurify instance, which failed to filter event handler attributes like onclick and onload when used within Umbraco web components (umb-, uui-, ufm-*). This allows for the injection of malicious HTML.

Recommendations Update to Umbraco version 16.5.1 or later. Update to Umbraco version 17.2.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-31833

GHSA-VRQC-59MW-QQG7

Affected Products

Umbraco

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31833.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-vrqc-59mw-qqg7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31833 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31833 · Security Note
• https://osv.dev/vulnerability/GHSA-vrqc-59mw-qqg7 · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://twitter.com/dailycve/status/2031915834793214065 · Twitter Post
• https://twitter.com/CVEnew/status/2031504063691383111 · Twitter Post
• https://t.me/CVEtracker/47038 · Telegram Post