GHSA-xxc6-35r7-796w
GitHub Security Advisory
Possible injection of HTML into user invite mails
✓ GitHub Reviewed
LOW
Has CVE
Advisory Details
#### Impact
A user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended.
#### Explanation of the vulnerability
A person with access to the backoffice and the "users" section could send a user invite and inject HTML code into the invite message.
Affected Packages
NuGet
Umbraco.CMS
Affected versions:
8.0.0
(fixed in 8.18.10)
NuGet
Umbraco.CMS
Affected versions:
9.0.0
(fixed in 10.7.0)
NuGet
Umbraco.CMS
Affected versions:
11.0.0
(fixed in 12.1.0)
Related CVEs
Key Information
2.5
/10
Dataset
Last updated: July 30, 2025 6:36 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.