CVE-2025-47280
Severity CVSS v4.0:
LOW
Type:
Unavailable / Other
Publication date:
13/05/2025
Last modified:
22/05/2025
Description
Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2, the 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address, potentially bypassing spam and email client security systems. This issue affects all (supported) versions Umbraco Forms and is patched in 13.4.2 and 15.1.2. Unpatched or unsupported versions can workaround this issue by using the `Send email with template (Razor)` workflow instead or writing a custom workflow type. To avoid accidentally using the vulnerable workflow again, the `SendEmail` workflow type can be removed using a composer available in the GitHub Security Advisory for this vulnerability.
Impact
Base Score 4.0
2.30
Severity 4.0
LOW
Base Score 3.x
6.10
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:* | 7.0.0 (including) | 13.4.2 (excluding) |
| cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:* | 14.0.0 (including) | 15.1.2 (excluding) |
To consult the complete list of CPE names with products and versions, see this page