← Vulnerability feed

Vulnerability record · CVE-2025-23041 · published 14 January 2025

CVE-2025-23041: Umbraco forms improper input validation vulnerability

Umbraco · Umbraco Forms

Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are advised to upgrade. There are no known workarounds for this issue.

5.3 CVSS 3.1 Medium EPSS 0.38% · top 71.0% CWE-20 · Improper input validation
5.3CVSS 3.1 base score
0.38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-9v8m-qv22-f268 PatchThird Party Advisory

Track CVE-2025-23041 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-33224Umbraco forms unrestricted file upload vulnerabilityFile upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file.EPSS 0.73%7.5CVE-2025-68924Umbraco forms inclusion from untrusted sphere vulnerabilityIn Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code …EPSS 0.77%7.5CVE-2020-7685Umbraco forms insecure default initialization vulnerabilityThis affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file typ…EPSS 0.90%6.0CVE-2026-24687Umbraco forms path traversal vulnerabilityUmbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enu…EPSS 0.46%5.4CVE-2024-35239Umbraco forms cross-site scripting vulnerabilityUmbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject uns…EPSS 0.34%2.3CVE-2025-47280Umbraco forms vulnerabilityUmbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 a…EPSS 0.29%9.5CVE-2026-88771Citrix netscaler application delivery controller improper input validation vulnerabilityImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-…KEV9.5CVE-2026-93952Arista velocloud orchestrator improper input validation vulnerabilityVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality an…KEVEPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2025-23041), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.