Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1. If upgrading is not immediately possible, users can mitigate this vulnerability by configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\`) in the `fileName` parameter of the export endpoint, restricting network access to the Umbraco backoffice to trusted IP ranges, and/or blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required. However, upgrading to the patched version is strongly recommended.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| umbraco | Umbraco.Forms.Issues | 16.0.0 to before 16.4.1; 17.0.0 to before 17.1.1 | 16.4.1, 17.1.1 | Patch available | CNA |
| — | Umbraco.Forms (NuGet) | 16.0.0 to before 16.4.1 | 16.4.1 | Patch available | GHSA-hm5p-82g6-m3xh |
| — | Umbraco.Forms (NuGet) | 17.0.0 to before 17.1.1 | 17.1.1 | Patch available | GHSA-hm5p-82g6-m3xh |
- Umbraco.Forms.Issues Vendorumbraco Affected 16.0.0 to before 16.4.1; 17.0.0 to before 17.1.1 Fixed in 16.4.1, 17.1.1 Patch available CNA
- Umbraco.Forms (NuGet) Vendor— Affected 16.0.0 to before 16.4.1 Fixed in 16.4.1 Patch available GHSA-hm5p-82g6-m3xh
- Umbraco.Forms (NuGet) Vendor— Affected 17.0.0 to before 17.1.1 Fixed in 17.1.1 Patch available GHSA-hm5p-82g6-m3xh
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:* | 16.0.0 to before 16.4.1; 17.0.0 to before 17.1.1 | Vulnerable | umbraco |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
- cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:* Versions 16.0.0 to before 16.4.1; 17.0.0 to before 17.1.1 Vulnerable ·umbraco
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
Remediation
- Fix · CNA Umbraco.Forms.Issues (umbraco) Fixed in 16.4.1, 17.1.1
- Fix · GHSA-hm5p-82g6-m3xh Umbraco.Forms (NuGet) Fixed in 16.4.1 Advisory →
- Fix · GHSA-hm5p-82g6-m3xh Umbraco.Forms (NuGet) Fixed in 17.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-24687
- 2026-10-03 Alias added: GHSA-hm5p-82g6-m3xh
References
More Umbraco Forms vulnerabilities
- TI-2021-12768 File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to… CVSS 3.1CRITICAL 9.8
- TI-2025-42380 Deserialization of untrusted data in umbraco Forms CVSS 3.1HIGH 7.5
- TI-2020-06205 Insecure Defaults CVSS 3.1HIGH 7.5
- TI-2025-16851 Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms CVSS 3.1MEDIUM 5.8
- TI-2024-23308 Stored Cross-site Scripting on Components of Umbraco Forms CVSS 3.1MEDIUM 5.4
- TI-2025-29810 Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow CVSS 4.0LOW 2.3
Sources
- CVE-2026-24687 · CVE Program
- CVE-2026-24687 · NVD
- FIRST EPSS
- GHSA-hm5p-82g6-m3xh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences