| Package | Affected versions | Patched versions |
|---|---|---|
| Umbraco.CMS | ≥ 11.0.0, < 11.5.0≥ 12.0.0, < 12.2.0≥ 7.0.0, < 7.15.11≥ 8.0.0, < 8.18.9≥ 9.0.0, < 10.7.0 | 11.5.012.2.07.15.118.18.910.7.0 |
| umbraco cms | ≥ 10.0.0, < 10.7.0≥ 11.0.0, < 11.5.0≥ 12.0.0, < 12.2.0≥ 7.0.0, < 7.15.11≥ 8.0.0, < 8.18.9 | 10.7.011.5.012.2.07.15.118.18.9 |
A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.
Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation
or
Serve all media from an different host (e.g cdn) that where umbraco is hosted
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free