~ / search / GHSA-vr9v-27gg-qgx4

GHSA-vr9v-27gg-qgx4

Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-46609

Packages

EcosystemPackageAffectedFixed in
NuGet Umbraco.Cms >= 14.0.0, < 17.4.0 17.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Authenticated users are able to inject HTML vulnerability into an input field, which is rendered in the confirmation dialog without proper output encoding. ### Patches This issue has been patched in 17.4.0

References

External links from the advisory. They lead to third-party sites.