~ / search / GHSA-5955-cwv4-h7qh

GHSA-5955-cwv4-h7qh

Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-48927

Packages

EcosystemPackageAffectedFixed in
NuGet UmbracoCms >= 8.0.0, < 8.18.15 8.18.15
NuGet Umbraco.Cms >= 10.0.0, < 10.8.7 10.8.7
NuGet Umbraco.Cms >= 13.0.0, < 13.5.2 13.5.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. ### Workarounds Server-side file validation is available to strip script tags from file's content during the file upload process.

References

External links from the advisory. They lead to third-party sites.