4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46609

CVE-2026-46609: Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in the confirmation dialog without proper output encoding. This issue has been patched in version 17.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46609

CVE-2026-46609:

4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Umbraco.Cms	nuget	>= 14.0.0, <= 17.3.5	17.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic cross-site scripting (XSS) issue within the Umbraco backoffice. Authenticated users could inject HTML and script content into input fields, such as an entity's name. When an action like 'delete' or 'trash' was performed on that entity, a confirmation dialog would appear. This dialog would render the entity's name without proper output encoding or sanitization.

The root cause was identified in the frontend code, specifically in how Lit-based web components handled localized strings containing user-provided data. The unsafe pattern involved combining Lit's unsafeHTML directive with the application's localize.string() method. This combination rendered the string as raw HTML but failed to escape the arguments (e.g., the entity name) interpolated into it.

The patch addresses this systematically by introducing a new, safe helper method: localize.htmlString(). This new function ensures that all arguments are securely HTML-escaped before being included in the final string, which is then rendered. The fix involved replacing all instances of the vulnerable unsafeHTML(localize.string(...)) pattern across numerous backoffice components, primarily focusing on confirmation modals, with the new safe localize.htmlString() method. This prevents attackers from injecting executable scripts into the confirmation dialogs.

Vulnerable functions

UmbConfirmModalElement.render

src/Umbraco.Web.UI.Client/src/packages/core/modal/common/confirm/confirm-modal.element.ts

The `render` method of the generic confirmation modal (`UmbConfirmModalElement`) directly rendered the `content` property using `unsafeHTML` and `localize.string()`. This is the core of the vulnerability, as it allows unescaped HTML from user-controlled input (passed as `data.content`) to be rendered, leading to XSS.

UmbDeleteEntityAction.execute

src/Umbraco.Web.UI.Client/src/packages/core/entity-action/common/delete/delete.action.ts

This action triggers a confirmation modal when a user attempts to delete an entity. The entity's name (`item.name`), which is user-controllable, was passed as content to the vulnerable `UmbConfirmModalElement`. An attacker could craft a malicious entity name to trigger the XSS.

UmbTrashEntityAction.execute

src/Umbraco.Web.UI.Client/src/packages/core/recycle-bin/entity-action/trash/trash.action.ts

Similar to the delete action, the trash action triggers a confirmation modal. The user-controllable `item.name` was passed to the modal's content, which was rendered without proper encoding, making it a vector for XSS.

UmbDeleteWithRelationConfirmModalElement.render

src/Umbraco.Web.UI.Client/src/packages/relations/relations/entity-actions/delete/modal/delete-with-relation-modal.element.ts

This specialized confirmation modal, used for deleting items with relations, also contained the vulnerable pattern. It rendered a localized string containing the user-controllable item name (`this._name`) using `unsafeHTML`, leading to XSS.

UmbTrashWithRelationConfirmModalElement.render

src/Umbraco.Web.UI.Client/src/packages/relations/relations/entity-actions/trash/modal/trash-with-relation-modal.element.ts

This specialized confirmation modal for trashing items with relations was vulnerable. It rendered the user-controllable item name (`this._name`) inside the modal content without proper sanitization.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.