CVE-2026-24687: medium-severity vulnerability in Umbraco.Forms.Issues
Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6epss 0.5%
Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1. If upgrading is not immediately possible, users can mitigate this vulnerability by configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\`) in the `fileName` parameter of the export endpoint, restricting network access to the Umbraco backoffice to trusted IP ranges, and/or blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required. However, upgrading to the patched version is strongly recommended.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
umbraco · Umbraco.Forms.IssuesRelated CVEs — Umbraco.Forms.Issues
In the same product, most dangerous first.
CVE-2025-23041MEDIUMShort and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.FormsEPSS 0.4%CVE-2024-35239LOWStored Cross-site Scripting on Components of Umbraco FormsEPSS 0.3%CVE-2025-47280LOWUmbraco.Forms has HTML injection vulnerability in 'Send email' workflowEPSS 0.3%