CVE-2024-48927
Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Versions 13.5.2, 10.8,7, and 8.18.15 contain a patch for the issue. As a workaround, derver-side file validation is available to strip script tags from file's content during the file upload process.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Versions 13.5.2, 10.8,7, and 8.18.15 contain a patch for the issue. As a workaround, derver-side file validation is available to strip script tags from file's content during the file upload process.
- Record
CVE-2024-48927- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2024-2947
Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Versions 13.5.2, 10.8,7, and 8.18.15 contain a patch for the issue. As a workaround, derver-side file validation is available to strip script tags from file's content during the file upload process.
- Record
EUVD-2024-2947- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5955-cwv4-h7qh
Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
Impact
There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode.
Workarounds
Server-side file validation is available to strip script tags from file's content during the file upload process.
- Record
GHSA-5955-cwv4-h7qh- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
NVD
Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Versions 13.5.2, 10.8,7, and 8.18.15 contain a patch for the issue. As a workaround, derver-side file validation is available to strip script tags from file's content during the file upload process.
- Record
CVE-2024-48927- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-74, CWE-79
- Updated
- 2026-11-02
OSV
Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Versions 13.5.2, 10.8,7, and 8.18.15 contain a patch for the issue. As a workaround, derver-side file validation is available to strip script tags from file's content during the file upload process.
- Record
CVE-2024-48927- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVGHSA-5955-cwv4-h7qh
Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
Impact
There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode.
Workarounds
Server-side file validation is available to strip script tags from file's content during the file upload process.
- Record
GHSA-5955-cwv4-h7qh- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
UmbracoCmsNuGet |
8.0.0 up to 8.18.15 | 8.18.15 |
Umbraco.CmsNuGet |
10.0.0 up to 10.8.7 | 10.8.7 |
Umbraco.CmsNuGet |
13.0.0 up to 13.5.2 | 13.5.2 |
UmbracoCmsNuGet |
8.0.0 up to 8.18.15, plus listed versions 8.0.18.0.28.0.38.1.08.1.1 Show 45 moreShow less8.1.28.1.38.1.48.1.58.1.68.10.08.10.0-rc8.10.18.10.28.10.38.11.08.11.0-rc8.11.18.11.28.11.38.12.08.12.0-rc8.12.18.12.28.12.38.13.08.13.0-rc8.13.18.14.08.14.0-rc8.14.18.14.28.14.38.14.48.15.08.15.0-rc8.15.18.15.28.15.38.16.08.16.0-rc8.17.08.17.0-rc8.17.0-rc28.17.18.17.28.18.08.18.0-rc8.18.0-rc28.18.1 |
8.18.15 |
Umbraco.CmsNuGet |
10.0.0 up to 10.8.7, plus listed versions 10.0.110.1.010.1.0-rc10.1.0-rc210.1.1 Show 27 moreShow less10.2.010.2.0-rc10.2.110.3.010.3.0-rc10.3.110.3.210.4.010.4.0-rc10.4.110.4.210.5.010.5.0-rc10.5.110.6.010.6.0-rc10.6.110.7.010.7.0-rc10.8.010.8.0-rc10.8.110.8.210.8.310.8.410.8.510.8.6 |
10.8.7 |
Umbraco.CmsNuGet |
13.0.0 up to 13.5.2, plus listed versions 13.0.113.0.213.0.313.1.013.1.0-rc Show 16 moreShow less13.1.113.2.013.2.0-rc13.2.113.2.213.3.013.3.0-rc13.3.113.3.213.4.013.4.0-rc13.4.0-rc213.4.113.5.013.5.0-rc13.5.1 |
13.5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-48927 is a medium vulnerability (CVSS 4.6) in Umbraco Umbraco-cms, published October 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in UmbracoCms 8.18.15.
References
Left out here: 56 versions. The JSON record has them.