CVE-2026-31833

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31833", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T17:41:56.077Z", "datePublished": "2026-03-10T21:51:51.407Z", "dateUpdated": "2026-03-11T15:58:47.606Z"}, "containers": {"cna": {"title": "Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-vrqc-59mw-qqg7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-vrqc-59mw-qqg7"}], "affected": [{"vendor": "umbraco", "product": "Umbraco-CMS", "versions": [{"version": ">= 16.2.0, < 16.5.1", "status": "affected"}, {"version": ">= 17.0.0, < 17.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T21:51:51.407Z"}, "descriptions": [{"lang": "en", "value": "Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2."}], "source": {"advisory": "GHSA-vrqc-59mw-qqg7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T15:52:31.035353Z", "id": "CVE-2026-31833", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:58:47.606Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31833", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T15:52:31.035353Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:52:32.401Z"}}], "cna": {"title": "Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering", "source": {"advisory": "GHSA-vrqc-59mw-qqg7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "umbraco", "product": "Umbraco-CMS", "versions": [{"status": "affected", "version": ">= 16.2.0, < 16.5.1"}, {"status": "affected", "version": ">= 17.0.0, < 17.2.1"}]}], "references": [{"url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-vrqc-59mw-qqg7", "name": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-vrqc-59mw-qqg7", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T21:51:51.407Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31833", "state": "PUBLISHED", "dateUpdated": "2026-03-11T15:58:47.606Z", "dateReserved": "2026-03-09T17:41:56.077Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T21:51:51.407Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Umbraco-CMS", "vendor": "umbraco", "versions": [{"status": "affected", "version": ">= 16.2.0, < 16.5.1"}, {"status": "affected", "version": ">= 17.0.0, < 17.2.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "2BB33F17-782C-4F7C-AC48-CC05C1B1886D", "versionEndExcluding": "16.5.1", "versionStartIncluding": "16.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C8D4B05-B561-4CDB-8B2A-BD734F9E9A74", "versionEndExcluding": "17.2.2", "versionStartIncluding": "17.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2."}, {"lang": "es", "value": "Umbraco es un CMS de ASP.NET. Desde la versi\u00f3n 16.2.0 hasta antes de la 16.5.1 y la 17.2.2, un usuario autenticado del backoffice con acceso a Settings puede inyectar HTML malicioso en las descripciones de tipos de propiedades. Debido a una configuraci\u00f3n de attributeNameCheck (/.+/) excesivamente permisiva en la instancia de DOMPurify de UFM, los atributos de gestor de eventos como onclick y onload, cuando se usaban dentro de componentes web de Umbraco (umb-*, uui-*, ufm-*), no se filtraban. Esta vulnerabilidad est\u00e1 corregida en las versiones 16.5.1 y 17.2.2."}], "id": "CVE-2026-31833", "lastModified": "2026-06-17T10:34:32.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31833", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T15:52:31.035353Z", "version": "2.0.3"}}]}, "published": "2026-03-10T22:16:21.410", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-vrqc-59mw-qqg7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[16.2.0,16.5.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0.0,17.2.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "cms", "vendor": "umbraco"}], "analysis": {"en": {"generated_at": "2026-04-16T09:23:00.049184+00:00", "value": {"mitigation_remediation": ["Upgrade Umbraco CMS to version 16.5.1 or later, or 17.2.2 or later, to apply the vendor\u2011supplied fix", "If an upgrade is not immediately possible, reconfigure the UFM DOMPurify instance by restricting the attributeNameCheck pattern to disallow event\u2011handler attributes such as onclick and onload", "Limit back\u2011office user permissions so that only trusted administrators have Settings access to reduce the attack surface"], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Affected systems include Umbraco CMS versions from 16.2.0 up to, but not including, 16.5.1. The vulnerability is not present in 17.2.2. The vulnerability is present in the UFM rendering pipeline and specifically impacts the attribute filtering of DOMPurify. Users should verify that their installed version is at least 16.5.1 or 17.2.2 to ensure the issue has been fixed.", "description_and_impact": "A permissive configuration in the UFM DOMPurify instance allowed event\u2011handler attributes such as onclick and onload to bypass sanitization. An authenticated back\u2011office user with access to Settings can inject malicious HTML into property\u2011type descriptions, enabling the execution of arbitrary JavaScript in users\u2019 browsers when the affected CMS loads the web components (umb\u2011*, uui\u2011*, ufm\u2011*). This flaw falls under CWE\u201179 and can compromise the confidentiality and integrity of data processed by the application, as well as the user experience for unsuspecting end users.", "risk_and_exploitability": "The CVSS score for this vulnerability is 6.7, indicating a moderate severity. The EPSS score is less than 1\u202f%, suggesting a low probability of exploitation in the general population. It is not listed in the CISA KEV catalog. The attack vector requires an authenticated user with back\u2011office Settings access, and the flaw can be exploited by injecting crafted HTML that preserves event\u2011handler attributes, leading to living cross\u2011site script attacks in the front\u2011end of the site."}}}}, "created": "2026-03-11T11:41:58.087166+00:00", "updated": "2026-04-16T09:30:06.046606+00:00", "vendors": ["umbraco", "umbraco$PRODUCT$cms"]}