Umbraco.Cms Known Vulnerabilities & Fixes
Umbraco.Cms has 18 known security vulnerabilities in NuGet (.NET). Upgrade to version 18.0.2 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 18.0.2
Upgrading to 18.0.2 or later resolves all 18 known vulnerabilities in Umbraco.Cms. Run: dotnet add package Umbraco.Cms --version 18.0.2
Is Umbraco.Cms in your project?
Check if you're affected and upgrade to 18.0.2 to stay secure.
Security Summary
- 32 affected version ranges have been identified across these 18 advisories.
- 94% of known issues have a published fixed version.
- Remediation: dotnet add package Umbraco.Cms
Vulnerabilities
18 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed May 17, 2022, most recently Sep 17, 2026 (1585 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2025-32017 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users | HIGH | 14.0.0, 14.0.0-rc1, 14.0.0-rc2, 14.0.0-rc3 (+34 more) | 14.3.4, 15.3.1 |
| CVE-2026-69197 Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion | HIGH | 12.0.0, 12.0.1, 12.1.0, 12.1.0-rc (+194 more) | 13.15.1, 17.5.3, 18.0.2 |
| CVE-2026-31834 Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks | HIGH | 15.3.1, 15.4.0, 15.4.0-rc, 15.4.0-rc2 (+41 more) | 16.5.1, 17.2.2 |
| CVE-2015-8814 Umbraco CMS vulnerable to CSRF | HIGH | All versions | 7.4.0 |
| CVE-2015-8813 Umbraco CMS vulnerable to CSRF | HIGH | All versions | 7.4.0 |
| CVE-2026-46616 Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers | MEDIUM | 10.0.0, 10.0.0-rc1, 10.0.0-rc2, 10.0.0-rc3 (+188 more) | 13.14.0, 17.4.0 |
| CVE-2026-31832 Umbraco Backoffice API Allows Unauthorized Modification of Domain Data | MEDIUM | 14.0.0, 14.1.0, 14.1.0-rc, 14.1.0-rc2 (+75 more) | 16.5.1, 17.2.2 |
| CVE-2024-10761 XSS/HTML Injection Vulnerability in Umbraco Preview Badge | MEDIUM | 11.0.0, 11.1.0, 11.1.0-rc, 11.2.0 (+84 more) | 13.5.3, 14.3.2, 15.1.2 (+1 more) |
| CVE-2025-49147 Umbraco CMS disclosure of configured password requirements | MEDIUM | 10.0.0, 10.0.1, 10.1.0, 10.1.0-rc (+70 more) | 10.8.11, 13.9.2 |
| CVE-2025-48953 Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads | MEDIUM | 14.0.0, 14.1.0, 14.1.0-rc, 14.1.0-rc2 (+35 more) | 15.4.2 |
| CVE-2025-46736 Umbraco Makes User Enumeration Feasible Based on Timing of Login Response | MEDIUM | 11.0.0, 11.0.0-rc1, 11.0.0-rc2, 11.0.0-rc3 (+150 more) | 13.8.1, 10.8.10 |
| CVE-2025-24011 Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes | MEDIUM | 14.0.0, 14.1.0, 14.1.0-rc, 14.1.0-rc2 (+14 more) | 14.3.2, 15.1.2 |
| CVE-2025-66625 Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality | MEDIUM | 10.0.0, 10.0.1, 10.1.0, 10.1.0-rc (+134 more) | 13.12.1 |
| CVE-2024-43377 Umbraco CMS Improper Access Control vulnerability | MEDIUM | 14.0.0, 14.1.0, 14.1.0-rc, 14.1.0-rc2 (+1 more) | 14.1.2 |
| CVE-2025-67288 Umbraco CMS has an arbitrary file upload vulnerability | MEDIUM | 10.0.0, 10.0.0-rc1, 10.0.0-rc2, 10.0.0-rc3 (+251 more) | No fix available |
| CVE-2026-31833 Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering | MEDIUM | 16.2.0, 16.3.0, 16.3.0-rc, 16.3.0-rc2 (+21 more) | 16.5.1, 17.2.2 |
| CVE-2024-48927 Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice | MEDIUM | 10.0.0, 10.0.1, 10.1.0, 10.1.0-rc (+51 more) | 10.8.7, 13.5.2 |
| CVE-2026-46609 Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog | MEDIUM | 14.0.0, 14.1.0, 14.1.0-rc, 14.1.0-rc2 (+94 more) | 17.4.0 |
About This Data
Vulnerability data for Umbraco.Cms is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related NuGet (.NET) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of Umbraco.Cms.