Every CVE Search/ Get API key

CVE-2023-49279

Umbraco CMS vulnerable to stored XSS via SVG File Upload

3.7 LowFix available

Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.39%Up 0.3 points since Dec 13, 2023
90%50%10%1%

What each source reports

CVE List Score used 3.7

Umbraco CMS vulnerable to stored XSS via SVG File Upload

Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.

Record
CVE-2023-49279
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2023-3134 3.7

Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.

Record
EUVD-2023-3134
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-6xmx-85x3-4cv2 0.0

Stored XSS via SVG File Upload

Impact

A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.

Workaround

Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation

or

Serve all media from an different host (e.g cdn) that where umbraco is hosted

Record
GHSA-6xmx-85x3-4cv2
CVSS 3.1
0.0 NoneCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 3.7

Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.

Record
CVE-2023-49279
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 3.7

Umbraco CMS vulnerable to stored XSS via SVG File Upload

Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.

Record
CVE-2023-49279
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-6xmx-85x3-4cv2 0.0

Stored XSS via SVG File Upload

Impact

A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.

Workaround

Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation

or

Serve all media from an different host (e.g cdn) that where umbraco is hosted

Record
GHSA-6xmx-85x3-4cv2
CVSS 3.1
0.0 NoneCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:N
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
Umbraco.CMS
NuGet
 7.0.0 up to 7.15.11
7.15.11
Umbraco.CMS
NuGet
 8.0.0 up to 8.18.9
8.18.9
Umbraco.CMS
NuGet
 9.0.0 up to 10.7.0
10.7.0
Umbraco.CMS
NuGet
 11.0.0 up to 11.5.0
11.5.0
Umbraco.CMS
NuGet
 12.0.0 up to 12.2.0
12.2.0
Umbraco.CMS
NuGet
 9.0.0 up to 10.7.0, plus listed versions
10.0.010.0.0-rc110.0.0-rc210.0.0-rc310.0.0-rc4
Show 45 moreShow less
10.0.0-rc510.0.110.1.010.1.0-rc10.1.0-rc210.1.110.2.010.2.0-rc10.2.110.3.010.3.0-rc10.3.110.3.210.4.010.4.0-rc10.4.110.4.210.5.010.5.0-rc10.5.110.6.010.6.0-rc10.6.110.7.0-rc9.0.19.1.09.1.0-rc9.1.19.1.29.2.09.2.0-rc9.3.09.3.0-rc9.3.19.4.09.4.0-rc9.4.19.4.29.4.39.5.09.5.0-rc9.5.0-rc29.5.0-rc39.5.19.5.2
10.7.0
Umbraco.CMS
NuGet
 11.0.0 up to 11.5.0, plus listed versions
11.1.011.1.0-rc11.2.011.2.0-rc11.2.1
Show 9 moreShow less
11.2.211.3.011.3.0-rc11.3.111.4.011.4.0-rc11.4.111.4.211.5.0-rc
11.5.0
Umbraco.CMS
NuGet
 12.0.0 up to 12.2.0, plus listed versions
12.0.112.1.012.1.0-rc12.1.112.1.212.2.0-rc
12.2.0

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-49279 is a low vulnerability (CVSS 3.7) in Umbraco Cms, published December 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in Umbraco.CMS 7.15.11.

References

This page doesn't list everything

Left out here: 2 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open