CVE-2026-31833
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-, uui-, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-, uui-, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.
- Record
CVE-2026-31833- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-10936
Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-, uui-, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.
- Record
EUVD-2026-10936- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vrqc-59mw-qqg7
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
Description
An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered.
Impact
As property type descriptions support Markdown/HTML via the UFM rendering pipeline, injected event handlers are rendered in the backoffice interface, resulting in a stored XSS affecting other backoffice users.
Patches
The issue is patched in 16.5.1 and 17.2.2.
Workarounds
There is no workaround other than upgrading.
References
https://docs.umbraco.com/umbraco-cms/reference/umbraco-flavored-markdown
- Record
GHSA-vrqc-59mw-qqg7- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-, uui-, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.
- Record
CVE-2026-31833- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-, uui-, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.
- Record
CVE-2026-31833- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-vrqc-59mw-qqg7
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
Description
An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered.
Impact
As property type descriptions support Markdown/HTML via the UFM rendering pipeline, injected event handlers are rendered in the backoffice interface, resulting in a stored XSS affecting other backoffice users.
Patches
The issue is patched in 16.5.1 and 17.2.2.
Workarounds
There is no workaround other than upgrading.
References
https://docs.umbraco.com/umbraco-cms/reference/umbraco-flavored-markdown
- Record
GHSA-vrqc-59mw-qqg7- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Umbraco.CmsNuGet |
16.2.0 up to 16.5.1 | 16.5.1 |
Umbraco.CmsNuGet |
17.0.0 up to 17.2.1 | 17.2.1 |
Umbraco.CmsNuGet |
16.2.0 up to 16.5.1, plus listed versions 16.3.016.3.0-rc16.3.0-rc216.3.0-rc316.3.0-rc4 Show 10 moreShow less16.3.116.3.216.3.316.3.416.4.016.4.0-rc16.4.0-rc216.4.116.5.016.5.0-rc |
16.5.1 |
Umbraco.CmsNuGet |
17.0.0 up to 17.2.2, plus listed versions 17.0.117.0.217.1.017.1.0-rc17.2.017.2.0-rc17.2.0-rc217.2.1 |
17.2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-31833 is a medium vulnerability (CVSS 6.7) in Umbraco Cms, published March 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in Umbraco.Cms 16.5.1.