CVE-2026-31833 in Umbraco
Summary
by MITRE • 03/11/2026
Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/16/2026
This vulnerability exists within the Umbraco content management system where authenticated backoffice users with Settings access can inject malicious HTML into property type descriptions. The flaw stems from an overly permissive attributeNameCheck configuration set to the regular expression pattern /.+/ within the UFM DOMPurify instance. This configuration fails to properly filter event handler attributes such as onclick and onload when they are used within Umbraco web components that utilize the umb-, uui-, and ufm-* naming conventions. The vulnerability represents a significant security risk as it allows privilege escalation through cross-site scripting attacks, enabling attackers to execute arbitrary JavaScript code within the context of the authenticated user's session.
The technical implementation of this vulnerability demonstrates a classic DOM-based cross-site scripting flaw that operates within the Umbraco backoffice environment. The overly permissive regular expression /.+/ in the attributeNameCheck configuration bypasses normal security filtering mechanisms that should prevent the inclusion of dangerous HTML attributes. This misconfiguration affects the UFM DOMPurify library which is responsible for sanitizing HTML content, specifically failing to strip out potentially dangerous event handler attributes that could be exploited for malicious purposes. The vulnerability is particularly concerning because it targets the Settings section of the backoffice, which typically requires elevated privileges to access, making it a prime target for privilege escalation attacks.
The operational impact of this vulnerability extends beyond simple XSS exploitation as it enables attackers to perform session hijacking, data exfiltration, and further lateral movement within the Umbraco environment. An attacker with Settings access can craft malicious HTML content that, when rendered in the backoffice interface, executes arbitrary JavaScript code in the context of other authenticated users. This creates a persistent threat vector that can be used to steal session cookies, modify content, or escalate privileges to other users with different access levels. The vulnerability affects multiple versions of Umbraco including releases from 16.2.0 through 16.5.0 and 17.2.0 through 17.2.1, representing a significant attack surface across the Umbraco ecosystem.
The fix implemented in versions 16.5.1 and 17.2.2 addresses the root cause by tightening the attributeNameCheck configuration to properly filter out dangerous HTML attributes. This remediation aligns with security best practices outlined in CWE-79, which addresses Cross-Site Scripting vulnerabilities, and follows the ATT&CK framework's T1566.001 technique for Initial Access through malicious HTML content. Organizations should immediately upgrade to the patched versions to prevent exploitation, while also implementing additional security controls such as content security policies, regular security audits of backoffice configurations, and monitoring for suspicious activity in the Settings section. The vulnerability serves as a reminder of the critical importance of proper HTML sanitization and the potential consequences of overly permissive security configurations in web applications.
This vulnerability classifies as a DOM-based cross-site scripting issue that exploits improper HTML sanitization within the Umbraco backoffice interface. The security implications are particularly severe because it allows authenticated users with limited privileges to create persistent XSS vectors that can affect other users with potentially higher privileges. The fix demonstrates the importance of proper input validation and the necessity of maintaining strict security configurations in web applications. Organizations using Umbraco should conduct thorough security assessments of their backoffice environments and ensure that all user access controls are properly enforced to prevent privilege escalation through similar vulnerabilities. The remediation process should include comprehensive testing to verify that the updated DOMPurify configuration properly filters all dangerous attributes while maintaining the functionality of legitimate web components.