{"id":"GHSA-2qrj-g9hq-chph","summary":"Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow","details":"### Impact\nThe 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address (potentially bypassing spam and email client security systems).\n\n### Patches\nThis issue affects all (supported) versions Umbraco Forms and is patched in 13.4.2 and 15.1.2.\n\n### Workarounds\nUnpatched or unsupported versions can workaround this issue by using the 'Send email with template (Razor)' workflow instead or [writing a custom workflow type](https://docs.umbraco.com/umbraco-forms/developer/extending/adding-a-workflowtype).\n\nTo avoid accidentally using the vulnerable workflow again, the `SendEmail` workflow type can be removed using the following composer (tested on Umbraco 10, 13, 14 and 15):\n```c#\nusing Umbraco.Cms.Core.Composing;\nusing Umbraco.Forms.Core.Providers.Extensions;\nusing Umbraco.Forms.Core.Providers.WorkflowTypes;\n\ninternal sealed class RemoveFormsSendEmailWorkflowTypeComposer : IComposer\n{\n    public void Compose(IUmbracoBuilder builder)\n        =\u003e builder.FormsWorkflows().Exclude\u003cSendEmail\u003e();\n}\n```","aliases":["CVE-2025-47280"],"modified":"2025-05-13T20:43:21.071435Z","published":"2025-05-13T20:17:36Z","database_specific":{"cwe_ids":["CWE-116"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2025-05-13T20:17:36Z","nvd_published_at":"2025-05-13T17:16:04Z"},"references":[{"type":"WEB","url":"https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-2qrj-g9hq-chph"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47280"},{"type":"PACKAGE","url":"https://github.com/umbraco/Umbraco.Forms.Issues"}],"affected":[{"package":{"name":"Umbraco.Forms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Forms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"13.4.2"}]}],"versions":["10.0.0","10.0.0-rc1","10.0.0-rc2","10.0.0-rc3","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","10.1.0","10.1.0-rc001","10.1.1","10.1.2","10.1.3","10.2.0","10.2.0-rc001","10.2.1","10.2.2","10.2.3","10.2.4","10.3.0","10.3.0-rc001","10.3.1","10.3.2","10.3.3","10.4.0","10.4.0-rc1","10.5.0","10.5.0-rc1","10.5.1","10.5.2","10.5.3","10.5.4","10.5.5","10.5.6","10.5.7","11.0.0","11.0.0-rc1","11.0.0-rc2","11.0.0-rc3","11.0.1","11.0.2","11.0.3","11.1.0","11.1.0-rc001","11.1.1","11.1.2","11.1.3","11.2.0","11.2.0-rc1","11.2.1","12.0.0","12.0.0-rc1","12.0.0-rc2","12.0.0-rc3","12.0.0-rc4","12.0.0-rc5","12.1.0","12.1.0-rc1","12.1.1","12.1.2","12.2.0","12.2.0-rc1","12.2.1","12.2.2","12.2.3","12.2.4","13.0.0","13.0.0-rc1","13.0.0-rc2","13.0.0-rc3","13.0.0-rc4","13.0.0-rc5","13.0.1","13.0.2","13.1.0","13.1.0-rc","13.1.1","13.1.2","13.2.0","13.2.0-rc1","13.2.0-rc2","13.2.1","13.2.2","13.2.3","13.2.4","13.2.5","13.3.0","13.3.0-rc1","13.3.1","13.3.2","13.3.3","13.4.0","13.4.0-rc1","13.4.0-rc2","13.4.0-rc3","13.4.1","9.0.0","9.0.0-beta002","9.0.0-beta003","9.0.0-beta004","9.0.0-rc001","9.0.1","9.1.0","9.1.0-rc001","9.1.1","9.2.0","9.2.0-rc001","9.2.1","9.2.2","9.3.0","9.3.0-rc001","9.4.0","9.4.0-rc001","9.4.1","9.4.2","9.5.0","9.5.0-rc001","9.5.1","9.5.2","9.5.3","9.5.4","9.5.5","9.5.6","9.5.7","9.5.8","9.5.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-2qrj-g9hq-chph/GHSA-2qrj-g9hq-chph.json"}},{"package":{"name":"UmbracoForms","ecosystem":"NuGet","purl":"pkg:nuget/UmbracoForms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"8.13.16"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.1.0","7.1.1","7.1.2","7.1.3","7.1.4","7.2.0","7.2.1","7.3.0","7.3.1","7.3.2","7.4.0","7.4.1","7.4.2","7.4.3","7.5.0","7.5.1","7.5.10","7.5.2","7.5.3","7.5.4","7.5.5","7.5.6","7.5.7","7.5.8","7.5.9","8.0.0","8.0.1","8.0.2","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.10.0","8.10.0-rc001","8.10.1","8.10.2","8.10.3","8.11.0","8.11.0-rc001","8.12.0","8.12.0-rc001","8.12.1","8.12.2","8.13.0","8.13.0-rc001","8.13.1","8.13.10","8.13.11","8.13.12","8.13.13","8.13.14","8.13.15","8.13.16","8.13.2","8.13.3","8.13.4","8.13.5","8.13.6","8.13.7","8.13.8","8.13.9","8.2.0","8.2.1","8.2.2","8.2.3","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4","8.4.0","8.4.1","8.4.2","8.4.3","8.4.4","8.5.0","8.5.1","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.6.0","8.6.1","8.6.2","8.7.0","8.7.0-rc","8.7.1","8.7.2","8.7.3","8.7.4","8.7.5","8.7.6","8.8.0","8.8.0-rc001","8.9.0","8.9.0-rc001","8.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-2qrj-g9hq-chph/GHSA-2qrj-g9hq-chph.json"}},{"package":{"name":"Umbraco.Forms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Forms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"15.1.2"}]}],"versions":["14.0.0","14.0.1","14.0.2","14.1.0","14.1.0-rc1","14.1.0-rc2","14.1.1","14.1.2","14.1.3","14.1.4","14.1.5","14.2.0","14.2.0-rc1","14.2.0-rc2","14.2.1","14.2.2","14.2.3","15.0.0","15.0.0-rc1","15.0.0-rc2","15.0.0-rc3","15.0.0-rc4","15.0.1","15.0.2","15.0.3","15.1.0","15.1.0-rc1","15.1.0-rc2","15.1.0-rc3","15.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-2qrj-g9hq-chph/GHSA-2qrj-g9hq-chph.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:U"}]}