What’s Vulnerable › Vulnerabilities
CVE-2026-31833: Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
- Severity: medium (CVSS 6.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-10 · updated 2026-06-17
- Weakness: CWE-79
Description
Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.
Affected products
- Umbraco-CMS: from 16.2.0 before 16.5.1; from 17.0.0 before 17.2.2 — fixed in 16.5.1, 17.2.2
How to fix
Upgrade to a fixed version: Umbraco-CMS 16.5.1, 17.2.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-31833 or the next vulnerability affects your stack