CVE-2026-24687 in Umbraco.Forms.Issues
Summary
by MITRE • 01/29/2026
Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1. If upgrading is not immediately possible, users can mitigate this vulnerability by configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\`) in the `fileName` parameter of the export endpoint, restricting network access to the Umbraco backoffice to trusted IP ranges, and/or blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required. However, upgrading to the patched version is strongly recommended.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/03/2026
This vulnerability in Umbraco Forms represents a critical path traversal flaw that enables authenticated backoffice users to access arbitrary files on the underlying filesystem of Mac and Linux installations. The issue stems from insufficient input validation within the export functionality of the forms module, specifically when processing the fileName parameter in the API endpoint. Attackers with valid backoffice credentials can manipulate this parameter to navigate through the file system hierarchy and retrieve sensitive information from the server. The vulnerability is particularly concerning because it affects the core file system access mechanisms of the operating system, potentially exposing configuration files, database credentials, and other sensitive data that should remain protected within the application's secure boundaries.
The technical implementation of this vulnerability aligns with CWE-22 Path Traversal and CWE-77 Path Traversal vulnerabilities, which are classified under the broader category of improper input validation attacks. The flaw manifests when the application fails to properly sanitize user-supplied input before using it in file system operations, allowing attackers to append directory traversal sequences such as ../ or ..\ to access files outside of the intended directory structure. This type of vulnerability is particularly dangerous in web applications where authenticated users have elevated privileges, as it can be exploited to bypass normal access controls and gain unauthorized access to system resources. The attack vector specifically targets the export endpoint at /umbraco/forms/api/v1/export, where the application processes the fileName parameter without adequate validation to prevent directory traversal attempts.
The operational impact of this vulnerability extends beyond simple information disclosure, as it can potentially lead to complete system compromise if attackers can access configuration files containing database credentials, encryption keys, or other sensitive system information. On Mac and Linux systems, the vulnerability is particularly severe because these operating systems handle file system permissions differently than Windows, potentially allowing more extensive access to system resources. The fact that Umbraco Cloud installations are unaffected due to their Windows environment demonstrates how operating system differences can significantly impact vulnerability exploitation potential. Organizations using Umbraco Forms on Unix-based systems face a significant risk of data breaches and system compromise if this vulnerability is not addressed promptly.
Mitigation strategies for this vulnerability include implementing network-level controls through WAF configurations or reverse proxies to block known path traversal sequences in the fileName parameter, restricting access to the Umbraco backoffice through IP whitelisting, and disabling the export endpoint entirely if the functionality is not required. These defensive measures provide temporary protection while organizations plan their upgrade cycles. However, the most effective and recommended approach is to upgrade to the patched versions 16.4.1 and 17.1.1, which contain proper input validation and sanitization mechanisms to prevent the exploitation of this path traversal vulnerability. The ATT&CK framework categorizes this type of vulnerability under T1059 Command and Scripting Interpreter and T1566 Credential Access, as it enables attackers to access system resources and potentially escalate privileges through the exploitation of authenticated access points. Organizations should also consider implementing additional security controls such as regular file system audits, monitoring for unusual file access patterns, and ensuring that all authenticated users have the minimum necessary privileges to reduce the potential impact of such vulnerabilities.