umbraco/umbraco-cms · Security
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
- GHSA ID
- GHSA-wv8v-rmw2-25wc
- CVE ID
- CVE-2025-24012
- Severity
- medium
- Published
- Updated
- CVSS
- 4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- CVSS v3
- 4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Description
Impact
Authenticated users are able to exploit an XSS vulnerability when viewing certain localized backoffice components.
Patches
Will be patched in 14.3.2 and 15.1.2.
Note: This issue was reported by Pratik Patil from NetSPI @Nexusss-ppatil
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')