umbraco/umbraco-cms · Security
Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
- GHSA ID
- GHSA-vr9v-27gg-qgx4
- CVE ID
- CVE-2026-46609
- Severity
- medium
- Published
- Updated
- CVSS
- 4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- CVSS v3
- 4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Description
Impact
Authenticated users are able to inject HTML vulnerability into an input field, which is rendered in the confirmation dialog without proper output encoding.
Patches
This issue has been patched in 17.4.0
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')