Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms
Priority LOW 32CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are advised to upgrade. There are no known workarounds for this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00387 32nd percentileScored 2026-11-07
Fix Fixed Umbraco.Forms.Issues (umbraco): 8.13.16, 10.5.7, 13.2.2 +1Umbraco.Forms (NuGet): 10.5.7, 13.2.2, 14.1.2+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| umbraco | Umbraco.Forms.Issues | before 8.13.16; 10.0.0 to before 10.5.7; 11.0.0 to before 13.2.2; 14.0.0 to before 14.1.2 | 8.13.16, 10.5.7, 13.2.2, 14.1.2 | Patch available | CNA |
| — | Umbraco.Forms (NuGet) | before 10.5.7 | 10.5.7 | Patch available | GHSA-9v8m-qv22-f268 |
| — | UmbracoForms (NuGet) | before 8.13.16 | 8.13.16 | Patch available | GHSA-9v8m-qv22-f268 |
| — | Umbraco.Forms (NuGet) | 11.0.0-rc1 to before 13.2.2 | 13.2.2 | Patch available | GHSA-9v8m-qv22-f268 |
| — | Umbraco.Forms (NuGet) | 14.0.0-beta001 to before 14.1.2 | 14.1.2 | Patch available | GHSA-9v8m-qv22-f268 |
- Umbraco.Forms.Issues Vendorumbraco Affected before 8.13.16; 10.0.0 to before 10.5.7; 11.0.0 to before 13.2.2; 14.0.0 to before 14.1.2 Fixed in 8.13.16, 10.5.7, 13.2.2, 14.1.2 Patch available CNA
- Umbraco.Forms (NuGet) Vendor— Affected before 10.5.7 Fixed in 10.5.7 Patch available GHSA-9v8m-qv22-f268
- UmbracoForms (NuGet) Vendor— Affected before 8.13.16 Fixed in 8.13.16 Patch available GHSA-9v8m-qv22-f268
- Umbraco.Forms (NuGet) Vendor— Affected 11.0.0-rc1 to before 13.2.2 Fixed in 13.2.2 Patch available GHSA-9v8m-qv22-f268
- Umbraco.Forms (NuGet) Vendor— Affected 14.0.0-beta001 to before 14.1.2 Fixed in 14.1.2 Patch available GHSA-9v8m-qv22-f268
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:* | before 8.13.15; 10.0.0 to before 10.5.7; 13.0.0 to before 13.2.2; 14.0.0 to before 14.1.2 | Vulnerable | umbraco |
- cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:* Versions before 8.13.15; 10.0.0 to before 10.5.7; 13.0.0 to before 13.2.2; 14.0.0 to before 14.1.2 Vulnerable ·umbraco
Remediation
- Fix · CNA Umbraco.Forms.Issues (umbraco) Fixed in 8.13.16, 10.5.7, 13.2.2, 14.1.2
- Fix · GHSA-9v8m-qv22-f268 Umbraco.Forms (NuGet) Fixed in 10.5.7 Advisory →
- Fix · GHSA-9v8m-qv22-f268 UmbracoForms (NuGet) Fixed in 8.13.16 Advisory →
- Fix · GHSA-9v8m-qv22-f268 Umbraco.Forms (NuGet) Fixed in 13.2.2 Advisory →
- Fix · GHSA-9v8m-qv22-f268 Umbraco.Forms (NuGet) Fixed in 14.1.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-23041
- 2026-10-03 Alias added: GHSA-9v8m-qv22-f268
References
More Umbraco Forms vulnerabilities
- TI-2021-12768 File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to… CVSS 3.1CRITICAL 9.8
- TI-2025-42380 Deserialization of untrusted data in umbraco Forms CVSS 3.1HIGH 7.5
- TI-2020-06205 Insecure Defaults CVSS 3.1HIGH 7.5
- TI-2026-19909 Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac CVSS 4.0MEDIUM 6.0
- TI-2024-23308 Stored Cross-site Scripting on Components of Umbraco Forms CVSS 3.1MEDIUM 5.4
- TI-2025-29810 Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow CVSS 4.0LOW 2.3
Sources
- CVE-2025-23041 · CVE Program
- CVE-2025-23041 · NVD
- FIRST EPSS
- GHSA-9v8m-qv22-f268 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences