← Vulnerability feed

Vulnerability record · CVE-2021-33224 · published 24 February 2023

CVE-2021-33224: Umbraco forms unrestricted file upload vulnerability

Umbraco · Umbraco Forms

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file.

9.8 CVSS 3.1 Critical EPSS 0.73% · top 47.5% CWE-434 · Unrestricted file upload
9.8CVSS 3.1 base score
0.73%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
9 Jul 2026Last modified by NVD

Description

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://our.umbraco.com/packages/developer-tools/umbraco-forms Release Notes
https://our.umbraco.com/packages/developer-tools/umbraco-forms Release Notes

Track CVE-2021-33224 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2025-68924Umbraco forms inclusion from untrusted sphere vulnerabilityIn Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code …EPSS 0.77%7.5CVE-2020-7685Umbraco forms insecure default initialization vulnerabilityThis affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file typ…EPSS 0.90%6.0CVE-2026-24687Umbraco forms path traversal vulnerabilityUmbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enu…EPSS 0.46%5.4CVE-2024-35239Umbraco forms cross-site scripting vulnerabilityUmbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject uns…EPSS 0.34%5.3CVE-2025-23041Umbraco forms improper input validation vulnerabilityUmbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are va…EPSS 0.38%2.3CVE-2025-47280Umbraco forms vulnerabilityUmbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 a…EPSS 0.29%10.0CVE-2026-56291Balbooa Forms Joomla extension unauthenticated arbitrary file upload RCEThe Balbooa Forms extension for Joomla before version 2.4.1 accepts file uploads without authentication and does not restrict file type, allowing exe…KEVEPSS 15%analysed10.0CVE-2026-48939iCagenda Joomla extension unrestricted file upload leads to PHP RCEThe iCagenda extension for Joomla fails to restrict file types in its file attachment feature, allowing arbitrary file uploads that result in PHP cod…KEVEPSS 20%analysed

Source: NIST National Vulnerability Database (record CVE-2021-33224), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.