—0.0
GHSA-6xmx-85x3-4cv2
Stored XSS via SVG File Upload
Quick fix
GHSA-6xmx-85x3-4cv2 — Umbraco.CMS: upgrade to the fixed version with the command below.
dotnet add package Umbraco.CMS --version 7.15.11Details
#### Impact A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.
#### Workaround Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation
or
Serve all media from an different host (e.g cdn) that where umbraco is hosted
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/Umbraco.CMS
Introduced in:
7.0.0Fixed in: 7.15.11Fix
dotnet add package Umbraco.CMS --version 7.15.11NuGet/Umbraco.CMS
Introduced in:
8.0.0Fixed in: 8.18.9Fix
dotnet add package Umbraco.CMS --version 8.18.9NuGet/Umbraco.CMS
Introduced in:
9.0.0Fixed in: 10.7.0Fix
dotnet add package Umbraco.CMS --version 10.7.0NuGet/Umbraco.CMS
Introduced in:
11.0.0Fixed in: 11.5.0Fix
dotnet add package Umbraco.CMS --version 11.5.0NuGet/Umbraco.CMS
Introduced in:
12.0.0Fixed in: 12.2.0Fix
dotnet add package Umbraco.CMS --version 12.2.0