Moderate severityNVD Advisory· Published Mar 10, 2026· Updated Mar 11, 2026
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
CVE-2026-31833
Description
Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
Umbraco.CmsNuGet | >= 16.2.0, < 16.5.1 | 16.5.1 |
Umbraco.CmsNuGet | >= 17.0.0, < 17.2.2 | 17.2.2 |
Affected products
2- Range: >= 16.2.0, < 16.5.1
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-vrqc-59mw-qqg7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-31833ghsaADVISORY
- github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-vrqc-59mw-qqg7ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.