https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T15:07:39.485008+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2023-49279 fkie_cve-2023-49279 2026-09-29T15:07:39.794030+00:00

Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.

 https://vulnerability.circl.lu/vuln/ghsa-6xmx-85x3-4cv2 GHSA-6xmx-85x3-4cv2 — Stored XSS via SVG File Upload 2026-09-29T15:07:39.794183+00:00

Affected: NuGet: Umbraco.CMS

#### Impact A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.

#### Workaround Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation

or

Serve all media from an different host (e.g cdn) that where umbraco is hosted

 https://vulnerability.circl.lu/vuln/gsd-2023-49279 gsd-2023-49279 2026-09-29T15:07:39.794252+00:00 gsd-2023-49279