CVE-2025-24012: Umbraco CMS XSS Vulnerability

CVE-2025-24012 Overview

CVE-2025-24012 is a cross-site scripting (XSS) vulnerability in Umbraco CMS, an open source .NET content management system. The flaw affects Umbraco versions 14.0.0 through 14.3.1 and 15.0.0 through 15.1.1. Authenticated users can inject and execute arbitrary JavaScript when other backoffice users view certain localized components. The issue stems from unescaped localization strings rendered in the backoffice UI [CWE-79]. Umbraco addressed the flaw in versions 14.3.2 and 15.1.2.

Critical Impact
Authenticated backoffice users can execute arbitrary script in another user's browser session, enabling session context abuse, backoffice action forgery, and information disclosure within the CMS administrative interface.

Affected Products

Umbraco CMS versions 14.0.0 through 14.3.1
Umbraco CMS versions 15.0.0 through 15.1.1
Umbraco backoffice localization components

Discovery Timeline

2025-01-21 - CVE-2025-24012 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24012

Vulnerability Analysis

The vulnerability resides in the Umbraco backoffice localization pipeline. Localized strings that contain user-influenced values are rendered into the DOM without HTML escaping. When a backoffice user views affected components, the browser interprets injected markup as executable script.

Exploitation requires an authenticated account with sufficient privileges to influence localized values. The attacker persists a malicious payload that later executes in the context of another backoffice user, including administrators. The scope changes to a broader user context, which is why impact extends beyond the attacker's own session.

Because execution occurs inside an authenticated backoffice session, attackers can invoke administrative endpoints, exfiltrate content, or pivot to further account compromise using the victim's authorization state.

Root Cause

The localization.controller.ts module returned localized values directly to Lit template rendering without HTML entity encoding. The fix introduces an escapeHTML utility from @umbraco-cms/backoffice/utils and applies it to localized output before insertion into the DOM.

Attack Vector

The attack is network-reachable, requires low privileges, and needs user interaction from a victim who views the affected backoffice component. No local access or elevated privileges are required for the attacker.

typescript

// Security patch: src/Umbraco.Web.UI.Client/src/libs/localization-api/localization.controller.ts
 import { umbLocalizationManager } from './localization.manager.js';
 import type { LitElement } from '@umbraco-cms/backoffice/external/lit';
 import type { UmbController, UmbControllerHost } from '@umbraco-cms/backoffice/controller-api';
+import { escapeHTML } from '@umbraco-cms/backoffice/utils';
 
 const LocalizationControllerAlias = Symbol();

Source: Umbraco CMS commit d4f8754

The patch imports escapeHTML and applies it to localized values before they are returned to Lit templates, neutralizing embedded HTML and script tags.

Detection Methods for CVE-2025-24012

Indicators of Compromise

Unexpected <script>, <img onerror=>, or event-handler attributes in Umbraco language/dictionary items or localized configuration values.
Backoffice user sessions issuing API calls that do not correspond to observed user activity in access logs.
Modifications to dictionary items or language files by low-privileged authenticated users shortly before privilege changes or content edits by administrators.

Detection Strategies

Audit Umbraco dictionary items and language records for HTML tags or JavaScript-like content strings.
Correlate backoffice authentication events with subsequent administrative API requests originating from the same session token.
Enable Content Security Policy (CSP) reporting on the backoffice origin to surface inline script execution attempts.

Monitoring Recommendations

Log and review changes to localization resources, including dictionary items, translation keys, and language packs.
Alert on non-administrator accounts editing localization data that is rendered to other users.
Monitor backoffice HTTP traffic for unusual POST activity to /umbraco/backoffice/* endpoints following a low-privilege login.

How to Mitigate CVE-2025-24012

Immediate Actions Required

Upgrade Umbraco CMS to version 14.3.2 or 15.1.2, matching the currently deployed major branch.
Review all backoffice user accounts and revoke access for users who no longer require it.
Inspect existing dictionary and language items for HTML or script content and sanitize any suspicious entries.

Patch Information

Umbraco released patched versions 14.3.2 and 15.1.2 that apply HTML escaping to localized values in the backoffice. Details are available in the GitHub Security Advisory GHSA-wv8v-rmw2-25wc and the remediation commit d4f8754.

Workarounds

Restrict backoffice access to trusted personnel and enforce least privilege on roles that can modify dictionary items or language files.
Deploy a strict Content Security Policy on the Umbraco backoffice origin to block inline script execution.
Place the Umbraco backoffice behind a web application firewall or VPN to reduce exposure while patching is scheduled.

bash

# Verify installed Umbraco.Cms version and upgrade to a patched release
dotnet list package | grep -i Umbraco.Cms

# Upgrade to the patched release for the 15.x branch
dotnet add package Umbraco.Cms --version 15.1.2

# Or for the 14.x branch
dotnet add package Umbraco.Cms --version 14.3.2