medium4.6
CVE-2025-24012
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
Impact
### Impact Authenticated users are able to exploit an XSS vulnerability when viewing certain localized backoffice components. ### Patches Will be patched in 14.3.2 and 15.1.2. Note: This issue was reported by Pratik Patil from NetSPI @Nexusss-ppatil
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Umbraco.Cms.StaticAssets | >= 14.0.0, < 14.3.2 | 14.3.2 |
| npm | @umbraco-cms/backoffice | >= 14.0.0, < 14.3.2 | 14.3.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Umbraco | Umbraco Cms | from 14.0.0 before 14.3.2 from 15.0.0 before 15.1.2 |