medium4.6
CVE-2024-48927
Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
Impact
### Impact There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. ### Workarounds Server-side file validation is available to strip script tags from file's content during the file upload process.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | UmbracoCms | >= 8.0.0, < 8.18.15 | 8.18.15 |
| nuget | Umbraco.Cms | >= 10.0.0, < 10.8.7 | 10.8.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Umbraco | Umbraco Cms | from 8.0 before 8.18.15 from 10.0 before 10.8.7 from 13.0 before 13.5.2 |