Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Workarounds Server-side file validation is available to strip script tags from file's content during the file upload process.
Recommended action: Upgrade to 8.18.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Backoffice displays the logout page with a session timeout message before the server session has fully expired, causing users to believe they have been logged out approximately 30 seconds before they actually are.
Recommended action: Upgrade to 8.18.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A user enumeration attack is possible. Affected versions Umbraco 10 with access to the native login screen Patches This is fixed in 10.8.5 Workarounds Disabling the native login screen, by exclusively use external logins.
Recommended action: Upgrade to 10.8.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.
Recommended action: Upgrade to 8.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.
Recommended action: Upgrade to 8.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
Recommended action: Upgrade to 8.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.