CVE-2026-24687

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24687", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-23T20:40:23.389Z", "datePublished": "2026-01-29T19:57:24.484Z", "dateUpdated": "2026-01-29T20:47:23.180Z"}, "containers": {"cna": {"title": "Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-hm5p-82g6-m3xh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-hm5p-82g6-m3xh"}], "affected": [{"vendor": "umbraco", "product": "Umbraco.Forms.Issues", "versions": [{"version": ">= 16.0.0, < 16.4.1", "status": "affected"}, {"version": ">= 17.0.0, < 17.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T19:57:24.484Z"}, "descriptions": [{"lang": "en", "value": "Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1. If upgrading is not immediately possible, users can mitigate this vulnerability by configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\\`) in the `fileName` parameter of the export endpoint, restricting network access to the Umbraco backoffice to trusted IP ranges, and/or blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required. However, upgrading to the patched version is strongly recommended."}], "source": {"advisory": "GHSA-hm5p-82g6-m3xh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T20:39:36.519302Z", "id": "CVE-2026-24687", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T20:47:23.180Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24687", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T20:39:36.519302Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T20:41:37.752Z"}}], "cna": {"title": "Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac", "source": {"advisory": "GHSA-hm5p-82g6-m3xh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "umbraco", "product": "Umbraco.Forms.Issues", "versions": [{"status": "affected", "version": ">= 16.0.0, < 16.4.1"}, {"status": "affected", "version": ">= 17.0.0, < 17.1.1"}]}], "references": [{"url": "https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-hm5p-82g6-m3xh", "name": "https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-hm5p-82g6-m3xh", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1. If upgrading is not immediately possible, users can mitigate this vulnerability by configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\\`) in the `fileName` parameter of the export endpoint, restricting network access to the Umbraco backoffice to trusted IP ranges, and/or blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required. However, upgrading to the patched version is strongly recommended."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T19:57:24.484Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24687", "state": "PUBLISHED", "dateUpdated": "2026-01-29T20:47:23.180Z", "dateReserved": "2026-01-23T20:40:23.389Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-29T19:57:24.484Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Umbraco.Forms.Issues", "vendor": "umbraco", "versions": [{"status": "affected", "version": ">= 16.0.0, < 16.4.1"}, {"status": "affected", "version": ">= 17.0.0, < 17.1.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:*", "matchCriteriaId": "9D0D409A-3CBC-4832-8AE6-CF2FB7E7F63C", "versionEndExcluding": "16.4.1", "versionStartIncluding": "16.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC3914CD-68D6-429E-8DCB-9C354BE94533", "versionEndExcluding": "17.1.1", "versionStartIncluding": "17.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1. If upgrading is not immediately possible, users can mitigate this vulnerability by configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\\`) in the `fileName` parameter of the export endpoint, restricting network access to the Umbraco backoffice to trusted IP ranges, and/or blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required. However, upgrading to the patched version is strongly recommended."}, {"lang": "es", "value": "Umbraco Forms es un constructor de formularios que se integra con el sistema de gesti\u00f3n de contenidos Umbraco. Es posible que un usuario autenticado del backoffice enumere y recorra rutas/archivos en el sistema de archivos del sistema y lea su contenido, en instalaciones de Umbraco con Forms en Mac/Linux. Dado que Umbraco Cloud se ejecuta en un entorno Windows, los usuarios de Cloud no se ven afectados. Este problema afecta a las versiones 16 y 17 de Umbraco Forms y est\u00e1 parcheado en las versiones 16.4.1 y 17.1.1. Si la actualizaci\u00f3n no es posible de inmediato, los usuarios pueden mitigar esta vulnerabilidad configurando un WAF o un proxy inverso para bloquear las solicitudes que contengan secuencias de salto de ruta ('../', '..\\') en el par\u00e1metro 'fileName' del endpoint de exportaci\u00f3n, restringiendo el acceso a la red del backoffice de Umbraco a rangos de IP de confianza, y/o bloqueando completamente el endpoint '/umbraco/forms/API/v1/export' si la funci\u00f3n de exportaci\u00f3n no es necesaria. Sin embargo, la actualizaci\u00f3n a la versi\u00f3n parcheada es muy recomendable."}], "id": "CVE-2026-24687", "lastModified": "2026-06-17T10:23:25.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24687", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T20:39:36.519302Z", "version": "2.0.3"}}]}, "published": "2026-01-29T20:16:10.430", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-hm5p-82g6-m3xh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:21:57.619034+00:00", "value": {"mitigation_remediation": ["Upgrade Umbraco Forms to version 16.4.1 or 17.1.1.", "If upgrading is not immediately possible, configure a WAF or reverse proxy to block requests containing ../ or ..\\ in the fileName parameter of the /umbraco/forms/api/v1/export endpoint.", "Restrict network access to the Umbraco backoffice to trusted IP ranges.", "If the export feature is not required, block the /umbraco/forms/api/v1/export endpoint entirely."], "summary": {"action": "Patch", "impact": "Path Traversal and Remote File Read"}, "threat_synthesis": {"affected_systems": "Affected deployments are Umbraco Forms versions 16 and 17 running on Linux or macOS. The issue does not affect Umbraco Cloud users as the platform operates on Windows. Patches are available in release 16.4.1 for the 16 branch and 17.1.1 for the 17 branch. Versions prior to these are vulnerable.", "description_and_impact": "Umbraco Forms, a form builder integrated with the Umbraco CMS, contains a path traversal flaw that allows an authenticated backoffice user to enumerate and traverse file system paths and read arbitrary files. The vulnerability exploits the export endpoint by accepting a fileName parameter that can contain traversal sequences. If exploited, an attacker can access sensitive configuration files, credentials, or other confidential data residing on the host, leading to a breach of confidentiality and potential integrity compromise.", "risk_and_exploitability": "The CVSS base score is 6, denoting moderate severity, and the EPSS score is less than 1\u202f%, indicating a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. An attacker requires authenticated backoffice access and can trigger the vulnerability via the /umbraco/forms/api/v1/export endpoint by providing a malicious fileName. Based on the description, it is inferred that the likely attack vector is an authenticated backoffice user, providing an authenticated attack vector with moderate impact, warranting priority remediation."}}}}, "created": "2026-01-30T08:42:32.073852+00:00", "updated": "2026-04-18T01:30:16.037113+00:00", "vendors": ["umbraco", "umbraco$PRODUCT$forms"]}