Medium severity6.7NVD Advisory· Published Mar 10, 2026· Updated Jun 17, 2026
CVE-2026-31833
CVE-2026-31833
Description
Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
Umbraco.CmsNuGet | >= 16.2.0, < 16.5.1 | 16.5.1 |
Umbraco.CmsNuGet | >= 17.0.0, < 17.2.2 | 17.2.2 |
Affected products
3cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*range: >=16.2.0,<16.5.1
- (no CPE)range: >= 16.2.0, < 16.5.1
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-vrqc-59mw-qqg7ghsaADVISORY
- github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-vrqc-59mw-qqg7nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-31833ghsaADVISORY
News mentions
0No linked articles in our index yet.