CVE-2025-24012
Fixed upstream EPSS <1%CVSS 4.6
Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 contain a patch.
Products: Umbraco CMS
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | Umbraco.Cms.StaticAssets | 14.3.2 |
| NuGet | Umbraco.Cms.StaticAssets | 15.1.2 |
| npm | @umbraco-cms/backoffice | 14.3.2 |
| npm | @umbraco-cms/backoffice | 15.1.2 |