Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. Patches This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1 Workarounds If upgrading is not immediately possible, users can mitigate this vulnerability by: Configuring a WAF or reverse proxy to block requests containing path traversal sequences (../, ..\) in the fileName parameter of the export endpoint Restricting network access to the Umbraco backoffice to trusted IP ranges Blocking the /umbraco/forms/api/v1/export endpoint entirely if the export feature is not required However, upgrading to the patched version is strongly recommended. References Credit to Kevin Joensen from Baldur Security for finding this vulnerability
Recommended action: Upgrade to 17.1.1 or 16.4.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Protected files uploaded through Umbraco Forms may be served to unauthenticated users when a CDN or caching layer is present and ImageSharp processes the request. ImageSharp sets aggressive cache headers by default, which can cause intermediary caches to store and serve files that should require authentication. Patches This issue affects all (supported) versions Umbraco Forms and is patched in 13.9.0, 16.4.0 and 17.1.0. Workarounds Add middleware to set cache headers for form uploads. Place the following code in your Startup.cs or Program.cs after app.UseStaticFiles() and any image processing middleware: Alternatively, configure your CDN to bypass caching for URLs matching /media/forms/upload/. Note: The vulnerability requires: - A CDN in front of the website - An authenticated user having previously requested the image - Knowledge of the form GUID, entry GUID, and image filename If no CDN is in use, this vulnerability does not apply.
Recommended action: Upgrade to 17.1.0, 16.4.0 or 13.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Authenticated user that has access to edit Forms may inject unsafe code into Forms components. Patches Issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13). References https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024 https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024 https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values
Recommended action: Upgrade to 13.0.1, 12.2.2, 10.5.3 or 8.13.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.