Low
Umbraco CMS vulnerable to stored XSS via SVG File Upload
Type: advisorySources: OSV
Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-49279
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 00:55 UTC · Revision 1
Source evidence
Umbraco CMS vulnerable to stored XSS via SVG File Upload
core-osv · Original sourcePublished 12 Dec 2023, 19:35 UTC
Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.
osv:CVE-2023-49279
Complete source record
{
"id": "603b842c9e3343cdefe634ccbda5f4c82e298ee89765cd733ed7ea950fbe4551",
"url": "https://osv.dev/vulnerability/CVE-2023-49279",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Umbraco CMS vulnerable to stored XSS via SVG File Upload",
"summary": "Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.",
"evidence": "osv:CVE-2023-49279",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2023-49279",
"aliases": [
"CVE-2023-49279",
"GHSA-6xmx-85x3-4cv2"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/umbraco/umbraco-cms",
"type": "GIT",
"events": [
{
"introduced": "f916a6bc18d2dfe6efafaa2b9d040f40b8c61a31"
},
{
"fixed": "bd60f4e2cea7ace2984dcfb8e61ef6512ea77c73"
},
{
"introduced": "b8db430615d76521a4394a23f9928dc7c12f87bd"
},
{
"fixed": "dac9986ed28b798400ced60d1b055771f6b973e1"
},
{
"introduced": "e3f4b86f1c28e0ec30a1ad2a079e308af4cbfbf7"
},
{
"fixed": "fd043f6ecf7b45aea1ec4dfdf2097c5673b0bff5"
},
{
"introduced": "d713b383c97ced18ecc53651952484735a011c29"
},
{
"fixed": "147b46440fa5ba399838ff2f8aaf115518e7ad41"
},
{
"introduced": "ba724ed97d77b9951a22fe693f9dd3bdd000047c"
},
{
"fixed": "173d8dcf47fcd18584b80190db14144a363cbdd5"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.15.11"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.18.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.7.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.5.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.2.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"release-12.2.0-rc",
"release-8.18.8",
"release-11.5.0-rc",
"release-12.1.0-rc",
"release-7.15.10",
"release-10.6.0-rc",
"release-8.18.7",
"release-8.18.6",
"release-7.15.9",
"release-8.18.5",
"release-7.15.8",
"release-10.1.0-rc",
"release-7.15.7",
"release-8.18.4",
"release-10.0.0-rc1",
"release-8.18.3",
"release-8.18.2",
"release-8.18.1",
"release-8.18.0",
"release-8.18.0-rc2",
"release-8.18.0-rc",
"release-9.0.0",
"release-9.0.0-rc004",
"release-9.0.0-rc003",
"release-8.17.0-rc",
"release-9.0.0-rc002",
"release-9.0.0-beta004",
"release-9.0.0-beta003",
"release-9.0.0-beta002",
"release-9.0.0-beta001",
"release-netcore-alpha004",
"release-7.15.6",
"release-8.10.0-rc",
"release-netcore-alpha002",
"release-netcore-0.5.0-alpha001",
"release-7.15.5",
"release-7.15.3",
"release-7.4.3",
"release-7.5.14",
"release-7.7.13",
"release-7.14.0",
"release/7.15.2",
"release-7.15.2",
"release-7.15.1",
"release-8.1.0",
"release-7.15.0",
"release-7.10.0",
"release-7.13.0",
"release-7.12.1",
"release-7.12.0",
"release-7.11.0",
"release-7.6.7",
"release-7.9.3",
"release-7.9.2",
"release-7.9.1",
"release-7.7.12",
"release-7.7.11",
"release-7.7.10",
"release-7.7.9",
"release-7.7.8",
"release-7.7.6",
"release-7.7.7",
"release-7.7.5",
"release-7.7.4",
"release-7.6.3",
"release-7.7.2",
"release-7.6.8",
"release-7.6.2",
"release-7.5.13",
"release-7.5.12",
"release-7.5.11",
"release-7.5.10",
"release-7.5.9",
"release-7.5.8",
"release-7.5.3",
"release-7.5.5",
"release-7.5.1",
"release-7.5.0",
"release-7.5.0-beta2",
"release-7.5.0-beta",
"release-7.4.2",
"release-7.4.1",
"release-7.4.0-beta2",
"release-7.4.0",
"release-7.4.0-RC1",
"release-7.2.0-beta2",
"release-7.2.0-beta",
"release-7.1.4",
"release-7.2.0-alpha",
"release-7.1.3",
"release-7.1.2",
"release-7.1.1",
"release-7.1.0",
"release-7.1.0-RC",
"release-7.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49279.json"
}
}
],
"modified": "2026-10-28T02:30:24.973444302Z",
"provider": "osv",
"references": [
"https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49279.json",
"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6xmx-85x3-4cv2",
"https://nvd.nist.gov/vuln/detail/CVE-2023-49279"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49279.json"
}
},
"related_cves": [
{
"value": "CVE-2023-49279",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 491369,
"published_at": "2023-12-12T19:35:05.931+00:00"
}