December 2025: patch Umbraco 13, then read the advent calendar

· JD + AI · Umbraco

December 2025: patch Umbraco 13, then read the advent calendar

If you run Umbraco 13, check your patch version before you read the rest of this. On 9 December Umbraco shipped 13.12.1 to close a vulnerability the vendor rates as moderate, affecting 13.0.0 through 13.12.0. Unsupported majors are exposed and will not get a fix.

That is December's entire must-do list. Everything else the month produced came from an advent calendar, which is a more interesting fact than it sounds.

The patch: what it actually is, and why you can probably schedule it

Security Advisory, December 9, 2025 — Andy Butland, Umbraco official blog The hole is in the endpoints that accept .udt uploads for dictionary items and content types. A crafted request can "enumerate the file system to determine the existence of specific files", per the advisory, and can also surface the NTLM hash of the application pool account. Two things lower the practical risk: the attacker needs an authenticated backoffice session first, and the hash is only useful if the app pool password is weak. Cloud projects on the latest minor were patched automatically the same day.

So this is a scheduled upgrade rather than a fire drill, with one exception. If your backoffice has stale accounts, shared logins, or contractors who left in November, the precondition is already met and you should treat it as urgent. The version numbers and severity here come from Umbraco's own advisory, which is the right kind of source for that claim.

Nine of the fourteen items below came from one site

24 Days in Umbraco publishes one article a day from 1 to 24 December and then goes quiet for eleven months. Nine of the fourteen sources in this post, 64% of them, come from that single calendar. We are stating that plainly because it should change how you read the list: this is not a representative sample of what the Umbraco community writes, it is what the community writes when a volunteer editorial calendar asks it to. In a normal month most of these authors publish nothing.

What Umbraco sold in December

A New Level of Clarity and Confidence for Enterprise Projects — Arnold Visser, Umbraco official blog Umbraco's own announcement of its own commercial packaging, so read it as a price-list change rather than as analysis. Umbraco for Enterprise bundles the CMS, licensed add-ons, Engage, the MCP Server, Cloud Professional with dedicated resources, phone support, defined SLAs, Extended Long-Term Support, GDPR tooling, a Customer Success Manager, and the not-yet-shipped Compose, all "bundled under one clear agreement". The post gives no number, so the only useful question is one your account manager has to answer: does the bundle cost less than what you already pay for the same parts separately, and does XLTS change your upgrade calendar? If neither answer is yes, nothing changed for you.

Why AI Needs a Platform, Not Just Potential — Mats Persson, Umbraco official blog Three hundred and thirty-one words of positioning with no product in it. We are listing it because it tells you where the vendor's argument is heading, not because it is worth your afternoon.

Umbraco Recognized as a G2 Leader Across CMS and Headless in the Winter 2026 Reports — Niels Christian Laursen, Umbraco official blog An awards post from the company that won the award. It has exactly one use, which is real: drop the badge into the procurement pack when a client's committee wants third-party validation before signing.

The most load-bearing claim of the month is not on a vendor page

Umbraco Compose - Under the Tree — Lasse Fredslund, 24 Days in Umbraco Fredslund writes as part of Umbraco's Orchestration Team, so this is a vendor roadmap post that happens to be published on a community site. Compose is a SaaS orchestration layer: you define Type Schemas, ingest from ERP, PIM, DAM and CMS through an ingestion API with optional JavaScript transforms, then query the lot through GraphQL, with webhooks on change. He is refreshingly direct about the target, which is the hand-rolled backend-for-frontend that every composable project ends up maintaining, and he names the failure mode as "composable regret". He also gives a commercial launch in Q1 2026 and an MCP server shortly after.

Treat that date as his rather than as a commitment. It is a roadmap claim on a community platform, not on umbraco.com, and if it is going into your 2026 plan you should confirm it with Umbraco directly first. The strategic read is simpler than the marketing: Compose is a paid, supported version of the integration layer you already wrote by hand, and the decision is whether you would rather maintain that code or rent it.

The pieces that answer a question you will actually have

Is Umbraco MCP Server Usable in Practice, or Is It Just a Phase? — Tobias Høst, 24 Days in Umbraco The most useful thing published about Umbraco and AI this month, because it is the only one that ran the experiment and reported the failures. Høst's finding, from a non-developer's seat with a developer driving: "The more creative the task, the less useful MCP becomes." He hit repeated errors and blames the shape of the API documentation, which was not written with prompting in mind. Read it before you promise a client prompt-driven content operations.

Communication in the Backoffice — Niels Lyngsø, 24 Days in Umbraco The Context API is how backoffice extensions in the new client are supposed to talk to each other, and this is the longest practical explanation of it anywhere. If your v14+ customisations are currently reaching across component boundaries by hand, this is the piece that tells you what you were meant to do instead.

Headless Umbraco: Two Paths to JSON Glory — Büşra Şengül, 24 Days in Umbraco The Content Delivery API against a custom route-hijacking implementation, with the actual JSON from both side by side. Useful in the architecture conversation where someone insists the built-in API cannot do what they need.

Importing Block List Items Programmatically in Umbraco 17 — Nathaniel Nunes, 24 Days in Umbraco Block List content is stored in a shape that punishes anyone trying to write it from code, which is why content migrations quietly become manual re-entry. This is the workaround, for v17.

5 Hidden Gems in Umbraco 17 — Dave Jonker, Dynamic Dave The small v17 changes that do not make the release notes headline but change day-to-day work. The companion piece to any upgrade business case built on the big-ticket items.

13 Actionable Uses For Umbraco Engage's Temporary Segments — Rachael Hand & Martha Sennitt, 24 Days in Umbraco Engage is licensed, so this only applies if you already pay for it. If you do, it is the answer to the recurring complaint that the personalisation module got bought and never used.

Introducing Umbraco to a new team — James Hobbs, 24 Days in Umbraco An honest account of onboarding a team that had used neither Umbraco nor any cloud CMS. Worth ten minutes before your next handover, which will go the same way.

10 tips to make your Umbraco site more sustainable — Lyle Lanley, 24 Days in Umbraco Most of the list is page-weight and caching discipline wearing a green label, which is fine, because those are the same changes that fix your Core Web Vitals.

An Introduction to Fluid Responsive Typography — Dean Leigh, 24 Days in Umbraco clamp(), container queries and container query units. Not Umbraco-specific at all, and the better reference for the next time a design system arrives with fourteen breakpoints.

What we're watching

The month's two hardest questions, does the MCP server work and what is Compose actually for, were both answered by people writing for a volunteer advent calendar, one of them on the vendor's behalf. Umbraco's own December output was a patch, a bundle, an awards post and three hundred words of AI positioning.

That is a teaching capacity problem, and it is seasonal. If Compose lands in Q1 2026 as Fredslund says, the explanation of how to model, ingest and query it has to exist in March, when 24 Days in Umbraco is nine months from its next publication. Betting a commercial launch on the ecosystem's goodwill in December is a strategy that works exactly once a year.

Sources

umbraco · umbraco-cms · umbraco-backoffice · umbraco-cloud · product · community · release · ai

2026 © Umbracolombia - All rights reserved.