Description
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
Scores
CVSS v3
5.4
EPSS
0.0023
EPSS Percentile
45.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Details
CWE
CWE-1188
Status
published
Products (2)
nuget/UmbracoForms
0NuGet
umbraco/umbraco_forms
Published
Jul 28, 2020
Tracked Since
Feb 18, 2026