CVE-2026-24687: Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac
Impact It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected.
Patches This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1
Workarounds If upgrading is not immediately possible, users can mitigate this vulnerability by: Configuring a WAF or reverse proxy to block requests containing path traversal sequences (../, ..\) in the fileName parameter of the export endpoint Restricting network access to the Umbraco backoffice to trusted IP ranges Blocking the /umbraco/forms/api/v1/export endpoint entirely if the export feature is not required
However, upgrading to the patched version is strongly recommended.
References Credit to Kevin Joensen from Baldur Security for finding this vulnerability
Other sources
Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1. If upgrading is not immediately possible, users can mitigate this vulnerability by configuring a WAF or reverse proxy to block requests containing path traversal sequences (../, ..\) in the fileName parameter of the export endpoint, restricting network access to the Umbraco backoffice to trusted IP ranges, and/or blocking the /umbraco/forms/api/v1/export endpoint entirely if the export feature is not required. However, upgrading to the patched version is strongly recommended.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24687?
CVE-2026-24687 is considered a high severity vulnerability due to its potential to allow authenticated users to traverse and enumerate the filesystem.
Who is affected by CVE-2026-24687?
CVE-2026-24687 affects Umbraco Forms versions from 16.0.0 to 16.4.1 and from 17.0.0 to 17.1.1 on Linux and Mac installations.
How do I fix CVE-2026-24687?
To remediate CVE-2026-24687, upgrade Umbraco Forms to version 16.4.1 or 17.1.1.
What exploitation can occur due to CVE-2026-24687?
Exploitation of CVE-2026-24687 may allow an attacker to read sensitive files from the system filesystem.
Is authentication required to exploit CVE-2026-24687?
Yes, exploitation of CVE-2026-24687 requires the attacker to be an authenticated backoffice-user.