https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 17:57:43 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2023-49279 <p>Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.</p> <p>Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2023-49279 https://vulnerability.circl.lu/vuln/ghsa-6xmx-85x3-4cv2 <p><strong>Affected:</strong> NuGet: Umbraco.CMS</p> <p>#### Impact A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.</p> <p>#### Workaround Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation</p> <p>or</p> <p>Serve all media from an different host (e.g cdn) that where umbraco is hosted</p> <p><strong>Affected:</strong> NuGet: Umbraco.CMS</p> <p>#### Impact A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.</p> <p>#### Workaround Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation</p> <p>or</p> <p>Serve all media from an different host (e.g cdn) that where umbraco is hosted</p> https://vulnerability.circl.lu/vuln/ghsa-6xmx-85x3-4cv2 https://vulnerability.circl.lu/vuln/gsd-2023-49279 gsd-2023-49279 https://vulnerability.circl.lu/vuln/gsd-2023-49279