Read the docs
TI-2025-29810 Aliases CVE-2025-47280GHSA-2qrj-g9hq-chph

Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow

Priority LOW 12CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2, the 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address, potentially bypassing spam and email client security systems. This issue affects all (supported) versions Umbraco Forms and is patched in 13.4.2 and 15.1.2. Unpatched or unsupported versions can workaround this issue by using the `Send email with template (Razor)` workflow instead or writing a custom workflow type. To avoid accidentally using the vulnerable workflow again, the `SendEmail` workflow type can be removed using a composer available in the GitHub Security Advisory for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.003 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Umbraco.Forms.Issues (umbraco): 13.4.2, 15.1.2Umbraco.Forms (NuGet): 13.4.2, 15.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
umbracoUmbraco.Forms.Issues7.0.0 to before 13.4.2; 15.0.0 to before 15.1.213.4.2, 15.1.2Patch availableCNA
—Umbraco.Forms (NuGet)7.0.0 to before 13.4.213.4.2Patch availableGHSA-2qrj-g9hq-chph
—UmbracoForms (NuGet)7.0.0 – 8.13.16—No fix listedGHSA-2qrj-g9hq-chph
—Umbraco.Forms (NuGet)14.0.0 to before 15.1.215.1.2Patch availableGHSA-2qrj-g9hq-chph
  • Umbraco.Forms.Issues Vendorumbraco Affected 7.0.0 to before 13.4.2; 15.0.0 to before 15.1.2 Fixed in 13.4.2, 15.1.2 Patch available CNA
  • Umbraco.Forms (NuGet) Vendor— Affected 7.0.0 to before 13.4.2 Fixed in 13.4.2 Patch available GHSA-2qrj-g9hq-chph
  • UmbracoForms (NuGet) Vendor— Affected 7.0.0 – 8.13.16 Fixed in — No fix listed GHSA-2qrj-g9hq-chph
  • Umbraco.Forms (NuGet) Vendor— Affected 14.0.0 to before 15.1.2 Fixed in 15.1.2 Patch available GHSA-2qrj-g9hq-chph

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:*7.0.0 to before 13.4.2; 14.0.0 to before 15.1.2Vulnerableumbraco
  • cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:* Versions 7.0.0 to before 13.4.2; 14.0.0 to before 15.1.2 Vulnerable ·umbraco

Remediation

  • Fix · CNA Umbraco.Forms.Issues (umbraco) Fixed in 13.4.2, 15.1.2
  • Fix · GHSA-2qrj-g9hq-chph Umbraco.Forms (NuGet) Fixed in 13.4.2 Advisory →
  • Fix · GHSA-2qrj-g9hq-chph Umbraco.Forms (NuGet) Fixed in 15.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-47280
  2. 2026-10-03 Alias added: GHSA-2qrj-g9hq-chph

References

Exploit 1

Advisory 1

Other 1

  • TI-2021-12768 File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2025-42380 Deserialization of untrusted data in umbraco Forms CVSS 3.1HIGH 7.5
  • TI-2020-06205 Insecure Defaults CVSS 3.1HIGH 7.5
  • TI-2025-16851 Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms CVSS 3.1MEDIUM 5.8
  • TI-2026-19909 Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac CVSS 4.0MEDIUM 6.0
  • TI-2024-23308 Stored Cross-site Scripting on Components of Umbraco Forms CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences