Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac
Impact
It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected.
Patches
This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1
Workarounds
If upgrading is not immediately possible, users can mitigate this vulnerability by:
- Configuring a WAF or reverse proxy to block requests containing path traversal sequences (
../,..\) in thefileNameparameter of the export endpoint - Restricting network access to the Umbraco backoffice to trusted IP ranges
- Blocking the
/umbraco/forms/api/v1/exportendpoint entirely if the export feature is not required
However, upgrading to the patched version is strongly recommended.
References
Credit to Kevin Joensen from Baldur Security for finding this vulnerability
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | Umbraco.Forms | >= 16.0.0, < 16.4.1, >= 17.0.0, < 17.1.1 | 16.4.1, 17.1.1 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-22- Platform
- .NET (NuGet)
- Package
Umbraco.Forms- Disclosed
- 30.01.2026
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-hm5p-82g6-m3xh - CC BY 4.0
Vulnerability history: Umbraco.Forms
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 05.2024 01.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
- Low 3
Disclosures per year
- 2024: 1
- 2025: 2
- 2026: 2
-
Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.