Remote Code Execution Vulnerability in Umbraco CMS Versions

CVE-2024-48927

What is CVE-2024-48927?

Umbraco, a popular open-source .NET content management system, has identified a remote code execution vulnerability present in its 13.x branch before version 13.5.2, the 10.x branch before version 10.8.7, and the 8.x branch before version 8.18.15. This vulnerability arises when backoffice users preview SVG files in full-screen mode, posing a potential risk for code execution. To address this issue, users are encouraged to upgrade to the patched versions: 13.5.2, 10.8.7, and 8.18.15. As an interim measure, server-side file validation can be implemented to remove script tags from the content during file uploads.

References