MEDIUM4.6
GHSA-5955-cwv4-h7qh
Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
Quick fix
GHSA-5955-cwv4-h7qh — UmbracoCms: upgrade to the fixed version with the command below.
dotnet add package UmbracoCms --version 8.18.15Details
### Impact There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode.
### Workarounds Server-side file validation is available to strip script tags from file's content during the file upload process.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/UmbracoCms
Introduced in:
8.0.0Fixed in: 8.18.15Fix
dotnet add package UmbracoCms --version 8.18.15NuGet/Umbraco.Cms
Introduced in:
10.0.0Fixed in: 10.8.7Fix
dotnet add package Umbraco.Cms --version 10.8.7NuGet/Umbraco.Cms
Introduced in:
13.0.0Fixed in: 13.5.2Fix
dotnet add package Umbraco.Cms --version 13.5.2