CVE-2025-24012

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 contain a patch.

Published: Jan 21, 2025
Updated: Aug 11, 2025
CVE: CVE-2025-24012
GHSA: GHSA-wv8v-rmw2-25wc
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
Umbraco.Cms.StaticAssets	14.0.0	14.3.2
Umbraco.Cms.StaticAssets	15.0.0	15.1.2
@umbraco-cms / backoffice	14.0.0	14.3.2
@umbraco-cms / backoffice	15.0.0	15.1.2
umbraco / umbraco_cms	15.0.0	15.1.2
umbraco / umbraco_cms	14.0.0	14.3.2

https://github.com/umbraco/Umbraco-CMS/commit/d4f8754f933895b3a329296e25ddea6f84a0aea2
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wv8v-rmw2-25wc

Vulnerability Database

CVE-2025-24012

Deep Security Visibility Without the Complexity