{"id":"GHSA-hm5p-82g6-m3xh","summary":"Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac","details":"### Impact\nIt's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. \n\n### Patches\nThis issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1\n\n### Workarounds\nIf upgrading is not immediately possible, users can mitigate this vulnerability by:\n* Configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\\`) in the `fileName` parameter of the export endpoint\n* Restricting network access to the Umbraco backoffice to trusted IP ranges\n* Blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required\n\nHowever, upgrading to the patched version is strongly recommended.\n\n### References\nCredit to Kevin Joensen from Baldur Security for finding this vulnerability","aliases":["CVE-2026-24687"],"modified":"2026-02-03T03:12:28.668803Z","published":"2026-01-30T14:43:18Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-01-30T14:43:18Z","nvd_published_at":"2026-01-29T20:16:10Z","cwe_ids":["CWE-22"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-hm5p-82g6-m3xh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24687"},{"type":"PACKAGE","url":"https://github.com/umbraco/Umbraco.Forms.Issues"}],"affected":[{"package":{"name":"Umbraco.Forms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Forms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.4.1"}]}],"versions":["16.0.0","16.1.0","16.2.0","16.2.0-rc","16.2.0-rc2","16.3.0","16.3.0-rc","16.3.0-rc2","16.3.1","16.4.0","16.4.0-rc","16.4.0-rc2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-hm5p-82g6-m3xh/GHSA-hm5p-82g6-m3xh.json"}},{"package":{"name":"Umbraco.Forms","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Forms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.0.0"},{"fixed":"17.1.1"}]}],"versions":["17.0.0","17.0.1","17.0.2","17.0.3","17.1.0","17.1.0-rc","17.1.0-rc2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-hm5p-82g6-m3xh/GHSA-hm5p-82g6-m3xh.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}