HTML Injection Vulnerability in Umbraco CMS by Umbraco
CVE-2026-46609

4.6MEDIUM

Key Information:

Vendor

Umbraco

Status
Umbraco-cms
Vendor
CVE Published:
10 June 2026

What is CVE-2026-46609?

Umbraco CMS, a widely used ASP.NET content management system, has a vulnerability that allows authenticated users to inject HTML code into input fields. This injected HTML is subsequently rendered in confirmation dialogs without proper output encoding, posing a security risk by potentially allowing the execution of malicious scripts. The issue affects Umbraco CMS from version 14.0.0 to before 17.4.0, and users are advised to upgrade to version 17.4.0 or later to mitigate this vulnerability.

Affected Version(s)

Umbraco-CMS >= 14.0.0, < 17.4.0

References

https://github.com/umbraco/Umbraco-CMS/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.