Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Umbraco.Cms | nuget | >= 12.0.0, < 13.15.1 | 13.15.1 |
| Umbraco.Cms | nuget | >= 14.0.0-rc1, < 17.5.3 | 17.5.3 |
| Umbraco.Cms | nuget | >= 18.0.0, < 18.0.2 | 18.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-69197, allows unauthorized access to protected content in Umbraco's Delivery API. The root cause is a missing authorization check during the expansion of nested content references. When a public content item references a protected item (e.g., via a Content Picker), and a client requests the public item with the ?expand query parameter, the API would serialize the full details of the protected item without verifying the client's access rights.
The analysis of the security patches (e.g., 26312a3f717a0f33bb3d7d28b14bef3592bdb0fe, 5360e2a9681ce2d0024be374e80339260bcc2511) points directly to the GetPropertyValue method within the ElementOnlyOutputExpansionStrategy class. In the vulnerable versions, this method simply retrieved the property's value and passed it along for serialization. It did not account for cases where the value was a reference to another content item that might have its own access restrictions.
The fix involves modifying GetPropertyValue to inspect the returned property value. If the value is an IApiContent object (or a collection of them), it now calls a new ApplyContentAccessControl method. This new method performs the crucial, previously missing access check. If the check fails, it clears the properties of the referenced content, ensuring that while the reference itself might be returned, the sensitive data within it is not leaked. The vulnerable function is therefore GetPropertyValue because it was the point where the expansion occurred without the necessary security validation.
Umbraco.Cms.Api.Common.Rendering.ElementOnlyOutputExpansionStrategy.GetPropertyValuesrc/Umbraco.Cms.Api.Common/Rendering/ElementOnlyOutputExpansionStrategy.cs
Umbraco.Cms.Web.Common.Rendering.ElementOnlyOutputExpansionStrategy.GetPropertyValuesrc/Umbraco.Web.Common/Rendering/ElementOnlyOutputExpansionStrategy.cs