CVE-2021-47776
Medium · 5.3Umbraco CMS contains a server-side request forgery vulnerability
CVSS
5.3
EPSS
0.4%
Published
Jan 15, 2026
CISA due date
—
The record
Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side requests to external hosts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | UmbracoCms | 8.14.1 | No fix |
| nuget | UmbracoCms | 8.14.1 | No fix |
Related vulnerabilities
- GHSA-h66j-xm43-47pp Umbraco CMS contains a server-side request forgery vulnerability Same vulnerability
- CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918
- CVE-2026-87953 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider… CWE-918
- CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in… CWE-918
- CVE-2026-112288 Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that… CWE-918
- CVE-2026-111936 Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability… CWE-918
- CVE-2026-94483 Next.js is a React framework for building full-stack web applications. CWE-918
- CVE-2026-102267 PyJWT is a Python implementation of JSON Web Token standards. CWE-918