CVE-2026-31833

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31833
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31833.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-31833
Aliases
Published
2026-03-10T21:51:51.407Z
Modified
2026-08-12T03:51:34.991574486Z
Severity
  • 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
Details

Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-, uui-, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31833.json"
}
References

Affected packages

Git / github.com/umbraco/umbraco-cms

Affected ranges

Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
4eae48e79472109ce1a26788c4bf9a00573859d4
Fixed
8555a97b399e2a26379804ce753ee74bfa48b09e
Introduced
da502e06ae836057de372c7c2ed69a1221c3d3b4
Fixed
11a412c0fd89c70af2fa76dd3478a3e8024dfeb2
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "16.2.0"
        },
        {
            "fixed": "16.5.1"
        },
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.2.2"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31833.json"