CVE-2026-46609

Published June 10th, 2026

View on NVD ↗

CVSS v3

4.6

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in the confirmation dialog without proper output encoding. This issue has been patched in version 17.4.0.

umbraco/Umbraco-CMS

Umbraco is a free and open source .NET content management system helping you deliver delightful digital experiences.

GitHub

5.2K