Kurz gesagt
- CVE-2026-46609 ist eine Schwachstelle (MITTEL (CVSS 4.6)) in Umbraco.Cms, umbraco cms (umbraco).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.14%, höher als bei 3.0% aller Schwachstellen.
- Abhilfe: auf 17.4.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| Umbraco.Cms NuGet | ≥ 14.0.0, < 17.4.0
| 17.4.0
|
| umbraco cms | ≥ 14.0.0, < 17.4.0
| 17.4.0
|
Description
Impact
Authenticated users are able to inject HTML vulnerability into an input field, which is rendered in the confirmation dialog without proper output encoding.
Patches
This issue has been patched in 17.4.0
NVD description
Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in the confirmation dialog without proper output encoding. This issue has been patched in version 17.4.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free