UpHeron
All vulnerabilities

Servers and applications

CVE-2023-49279

Stored XSS via SVG File Upload

Severity
Medium 5.4
Published
12 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.15.11, 8.18.9, 10.7.0, 11.5.0, 12.2.0
Also known as
GHSA-6xmx-85x3-4cv2
Sources
NVD, Project advisories (GitHub)

Description

Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a…

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • From 7.0.0 before 7.15.11
  • From 8.0.0 before 8.18.9
  • From 10.0.0 before 10.7.0
  • From 11.0.0 before 11.5.0
  • From 12.0.0 before 12.2.0
Umbraco CMSServers and applications · github:umbraco/umbraco-cms
  • From 7.0.0 before 7.15.11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-49279
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-49279
  • GitHub Advisory Database https://github.com/advisories/GHSA-6xmx-85x3-4cv2
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6xmx-85x3-4cv2