CVE-2025-47280: Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow
Impact The 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address (potentially bypassing spam and email client security systems).
Patches This issue affects all (supported) versions Umbraco Forms and is patched in 13.4.2 and 15.1.2.
Workarounds Unpatched or unsupported versions can workaround this issue by using the 'Send email with template (Razor)' workflow instead or writing a custom workflow type.
To avoid accidentally using the vulnerable workflow again, the SendEmail workflow type can be removed using the following composer (tested on Umbraco 10, 13, 14 and 15): c# using Umbraco.Cms.Core.Composing; using Umbraco.Forms.Core.Providers.Extensions; using Umbraco.Forms.Core.Providers.WorkflowTypes;
internal sealed class RemoveFormsSendEmailWorkflowTypeComposer : IComposer { public void Compose(IUmbracoBuilder builder) => builder.FormsWorkflows().Exclude<SendEmail>(); }
Other sources
Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2, the 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address, potentially bypassing spam and email client security systems. This issue affects all (supported) versions Umbraco Forms and is patched in 13.4.2 and 15.1.2. Unpatched or unsupported versions can workaround this issue by using the Send email with template (Razor) workflow instead or writing a custom workflow type. To avoid accidentally using the vulnerable workflow again, the SendEmail workflow type can be removed using a composer available in the GitHub Security Advisory for this vulnerability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47280?
CVE-2025-47280 is categorized as a medium severity vulnerability due to potential issues with user data handling.
How do I fix CVE-2025-47280?
To mitigate CVE-2025-47280, upgrade to Umbraco Forms versions 13.4.2 or 15.1.2 or later.
What does CVE-2025-47280 exploit?
CVE-2025-47280 exploits the lack of HTML encoding of user-provided field values in email messages sent by Umbraco Forms.
Which versions of Umbraco Forms are affected by CVE-2025-47280?
CVE-2025-47280 affects Umbraco Forms versions from 7.x up to, but not including, 13.4.2 and 15.1.2.
What impact does CVE-2025-47280 have on web applications?
CVE-2025-47280 can lead to security issues such as cross-site scripting (XSS) if an attacker submits malicious input.