Umbraco.Forms

Umbraco Forms is an extension for Umbraco CMS allowing editors to create and manage forms and review submissions.

View on Nuget

Activity

Latest release: 2w ago
Total releases: 260
Cadence: ~daily
Last 12 months: 84

Details

First release: Jul 15, 2021

Releases

Version	Released
`18.1.1` patch	Aug 27, 2026
`13.9.10` patch	Aug 27, 2026
`18.1.0` minor	Aug 20, 2026
`17.5.0` minor	Aug 20, 2026
`17.4.8` patch	Aug 18, 2026
`13.9.9` patch	Aug 18, 2026
`18.0.6` patch	Aug 18, 2026
`18.1.0-rc` pre	Aug 06, 2026
`17.5.0-rc` pre	Aug 06, 2026
`18.0.5` patch	Jul 28, 2026
`17.4.7` patch	Jul 28, 2026
`13.9.8` patch	Jul 28, 2026
`13.9.7` patch	Jul 13, 2026
`18.0.4` patch	Jul 13, 2026
`17.4.6` patch	Jul 13, 2026
`18.0.3` patch	Jul 02, 2026
`17.4.5` patch	Jul 02, 2026
`18.0.2` patch	Jul 01, 2026
`17.4.4` patch	Jul 01, 2026
`17.4.3` patch	Jun 30, 2026
`18.0.1` patch	Jun 30, 2026
`18.0.0` major	Jun 25, 2026
`18.0.0-rc2` pre	Jun 18, 2026
`17.4.2` patch	Jun 16, 2026
`17.4.1` patch	Jun 12, 2026
`18.0.0-rc1` pre	Jun 04, 2026
`17.4.0` minor	Jun 04, 2026
`17.4.0-rc` pre	May 14, 2026
`17.3.2` patch	May 01, 2026
`17.3.1` patch	Apr 30, 2026
`16.5.3` patch	Apr 30, 2026
`17.3.0` minor	Apr 16, 2026
`16.5.2` patch	Apr 16, 2026
`13.9.6` patch	Apr 16, 2026
`17.3.0-rc2` pre	Apr 09, 2026
`17.3.0-rc` pre	Apr 02, 2026
`13.9.5` patch	Mar 24, 2026
`17.2.1` patch	Mar 05, 2026
`16.5.1` patch	Mar 05, 2026
`13.9.4` patch	Mar 05, 2026
`17.2.0` minor	Mar 05, 2026
`16.5.0` minor	Mar 05, 2026
`13.9.3` patch	Mar 05, 2026
`16.5.0-rc2` pre	Feb 26, 2026
`17.2.0-rc2` pre	Feb 26, 2026
`13.9.2` patch	Feb 19, 2026
`17.2.0-rc` pre	Feb 19, 2026
`16.5.0-rc` pre	Feb 19, 2026
`13.9.1` patch	Feb 19, 2026
`17.1.3` patch	Feb 12, 2026

1–50 of 260

Dependencies (3)

Depends on

18.1.1

Used by

Supply-chain exposure

20 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (5)

CVE-2026-24687 GHSA-hm5p-82g6-m3xh Jan 30, 2026

Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac

Medium
Network Low Low None

Impact

It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected.

Patches

This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1

Workarounds

If upgrading is not immediately possible, users can mitigate this vulnerability by:

Configuring a WAF or reverse proxy to block requests containing path traversal sequences (../, ..\) in the fileName parameter of the export endpoint

Restricting network access to the Umbraco backoffice to trusted IP ranges

Blocking the /umbraco/forms/api/v1/export endpoint entirely if the export feature is not required

However, upgrading to the patched version is strongly recommended.

References

Credit to Kevin Joensen from Baldur Security for finding this vulnerability

Affected versions

16.0.016.1.016.2.016.2.0-rc16.2.0-rc216.3.016.3.0-rc16.3.0-rc216.3.116.4.016.4.0-rc16.4.0-rc2

+ 7 more Show less

17.0.017.0.117.0.217.0.317.1.017.1.0-rc17.1.0-rc2

Fixed in

16.4.117.1.1

References

https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-hm5p-82g6-m3xh
https://nvd.nist.gov/vuln/detail/CVE-2026-24687
https://github.com/umbraco/Umbraco.Forms.Issues

Updated Feb 03, 2026 · Source: OSV.dev
GHSA-7jxj-rpx7-ph2c Jan 22, 2026

Umbraco.Forms CDN may cache sensitive form uploads when processed by ImageSharp

3.1 / 10
Low
Network High None Required Unchanged Low None None

Impact

Protected files uploaded through Umbraco Forms may be served to unauthenticated users when a CDN or caching layer is present and ImageSharp processes the request. ImageSharp sets aggressive cache headers by default, which can cause intermediary caches to store and serve files that should require authentication.

Patches

This issue affects all (supported) versions Umbraco Forms and is patched in 13.9.0, 16.4.0 and 17.1.0.

Workarounds

Add middleware to set cache headers for form uploads. Place the following code in your Startup.cs or Program.cs after app.UseStaticFiles() and any image processing middleware:

app.Use(async (context, next) => { var path = context.Request.Path.Value; if (!string.IsNullOrEmpty(path) && path.StartsWith("/media/forms/upload/", StringComparison.OrdinalIgnoreCase)) { context.Response.OnStarting(() => { context.Response.Headers["Cache-Control"] = "private, no-store, no-cache, must-revalidate"; context.Response.Headers["Pragma"] = "no-cache"; context.Response.Headers["Expires"] = "0"; return Task.CompletedTask; }); } await next(); });

Alternatively, configure your CDN to bypass caching for URLs matching /media/forms/upload/*.

Note: The vulnerability requires:

A CDN in front of the website

An authenticated user having previously requested the image

Knowledge of the form GUID, entry GUID, and image filename

If no CDN is in use, this vulnerability does not apply.

Affected versions

10.0.010.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.210.0.310.0.410.0.510.1.010.1.0-rc00110.1.1

+ 191 more Show less

10.1.210.1.310.2.010.2.0-rc00110.2.110.2.210.2.310.2.410.3.010.3.0-rc00110.3.110.3.210.3.310.4.010.4.0-rc110.5.010.5.0-rc110.5.110.5.210.5.310.5.410.5.510.5.610.5.711.0.011.0.0-rc111.0.0-rc211.0.0-rc311.0.111.0.211.0.311.1.011.1.0-rc00111.1.111.1.211.1.311.2.011.2.0-rc111.2.112.0.012.0.0-rc112.0.0-rc212.0.0-rc312.0.0-rc412.0.0-rc512.1.012.1.0-rc112.1.112.1.212.2.012.2.0-rc112.2.112.2.212.2.312.2.413.0.013.0.0-rc113.0.0-rc213.0.0-rc313.0.0-rc413.0.0-rc513.0.113.0.213.1.013.1.0-rc13.1.113.1.213.2.013.2.0-rc113.2.0-rc213.2.113.2.213.2.313.2.413.2.513.3.013.3.0-rc113.3.113.3.213.3.313.4.013.4.0-rc113.4.0-rc213.4.0-rc313.4.113.4.213.5.013.5.0-rc13.6.013.7.013.7.0-rc13.7.0-rc213.8.013.8.0-rc13.8.0-rc213.9.0-rc4.0.09.0.09.0.0-beta0029.0.0-beta0039.0.0-beta0049.0.0-rc0019.0.19.1.09.1.0-rc0019.1.19.2.09.2.0-rc0019.2.19.2.29.3.09.3.0-rc0019.4.09.4.0-rc0019.4.19.4.29.5.09.5.0-rc0019.5.19.5.29.5.39.5.49.5.59.5.69.5.79.5.89.5.914.0.014.0.0-beta00114.0.0-beta00214.0.0-beta00314.0.0-beta00414.0.0-rc114.0.114.0.214.1.014.1.0-rc114.1.0-rc214.1.114.1.214.1.314.1.414.1.514.2.014.2.0-rc114.2.0-rc214.2.114.2.214.2.315.0.015.0.0-rc115.0.0-rc215.0.0-rc315.0.0-rc415.0.115.0.215.0.315.1.015.1.0-rc115.1.0-rc215.1.0-rc315.1.115.1.215.2.015.2.0-rc16.0.016.0.0-rc116.0.0-rc216.0.0-rc316.0.0-rc416.0.0-rc516.1.016.2.016.2.0-rc16.2.0-rc216.3.016.3.0-rc16.3.0-rc216.3.116.4.0-rc16.4.0-rc217.0.017.0.0-rc117.0.0-rc217.0.0-rc317.0.0-rc417.0.117.0.217.0.317.1.0-rc17.1.0-rc2

Fixed in

13.9.016.4.017.1.0

References

https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-7jxj-rpx7-ph2c
https://github.com/umbraco/Umbraco.Forms.Issues

Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-47280 GHSA-2qrj-g9hq-chph May 13, 2025

Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow

Low
Network Low None

Impact

The 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address (potentially bypassing spam and email client security systems).

Patches

This issue affects all (supported) versions Umbraco Forms and is patched in 13.4.2 and 15.1.2.

Workarounds

Unpatched or unsupported versions can workaround this issue by using the 'Send email with template (Razor)' workflow instead or writing a custom workflow type.

To avoid accidentally using the vulnerable workflow again, the SendEmail workflow type can be removed using the following composer (tested on Umbraco 10, 13, 14 and 15):

using Umbraco.Cms.Core.Composing; using Umbraco.Forms.Core.Providers.Extensions; using Umbraco.Forms.Core.Providers.WorkflowTypes; internal sealed class RemoveFormsSendEmailWorkflowTypeComposer : IComposer { public void Compose(IUmbracoBuilder builder) => builder.FormsWorkflows().Exclude<SendEmail>(); }

Affected versions

10.0.010.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.210.0.310.0.410.0.510.1.010.1.0-rc00110.1.1

+ 145 more Show less

10.1.210.1.310.2.010.2.0-rc00110.2.110.2.210.2.310.2.410.3.010.3.0-rc00110.3.110.3.210.3.310.4.010.4.0-rc110.5.010.5.0-rc110.5.110.5.210.5.310.5.410.5.510.5.610.5.711.0.011.0.0-rc111.0.0-rc211.0.0-rc311.0.111.0.211.0.311.1.011.1.0-rc00111.1.111.1.211.1.311.2.011.2.0-rc111.2.112.0.012.0.0-rc112.0.0-rc212.0.0-rc312.0.0-rc412.0.0-rc512.1.012.1.0-rc112.1.112.1.212.2.012.2.0-rc112.2.112.2.212.2.312.2.413.0.013.0.0-rc113.0.0-rc213.0.0-rc313.0.0-rc413.0.0-rc513.0.113.0.213.1.013.1.0-rc13.1.113.1.213.2.013.2.0-rc113.2.0-rc213.2.113.2.213.2.313.2.413.2.513.3.013.3.0-rc113.3.113.3.213.3.313.4.013.4.0-rc113.4.0-rc213.4.0-rc313.4.19.0.09.0.0-beta0029.0.0-beta0039.0.0-beta0049.0.0-rc0019.0.19.1.09.1.0-rc0019.1.19.2.09.2.0-rc0019.2.19.2.29.3.09.3.0-rc0019.4.09.4.0-rc0019.4.19.4.29.5.09.5.0-rc0019.5.19.5.29.5.39.5.49.5.59.5.69.5.79.5.89.5.914.0.014.0.114.0.214.1.014.1.0-rc114.1.0-rc214.1.114.1.214.1.314.1.414.1.514.2.014.2.0-rc114.2.0-rc214.2.114.2.214.2.315.0.015.0.0-rc115.0.0-rc215.0.0-rc315.0.0-rc415.0.115.0.215.0.315.1.015.1.0-rc115.1.0-rc215.1.0-rc315.1.1

Fixed in

13.4.215.1.2

References

https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-2qrj-g9hq-chph
https://nvd.nist.gov/vuln/detail/CVE-2025-47280
https://github.com/umbraco/Umbraco.Forms.Issues

Updated May 13, 2025 · Source: OSV.dev
CVE-2025-23041 GHSA-9v8m-qv22-f268 Jan 14, 2025

Umbraco Forms's Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length

5.8 / 10
Medium
Network Low None None Changed None None Low

Impact

Character limits configured by editors for short and long answer fields are validated only client-side, not server-side.

Patches

Patched in 8.13.16, 10.5.7, 13.2.2, 14.1.2

Affected versions

10.0.010.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.210.0.310.0.410.0.510.1.010.1.0-rc00110.1.1

+ 113 more Show less

10.1.210.1.310.2.010.2.0-rc00110.2.110.2.210.2.310.2.410.3.010.3.0-rc00110.3.110.3.210.3.310.4.010.4.0-rc110.5.010.5.0-rc110.5.110.5.210.5.310.5.410.5.510.5.64.0.09.0.09.0.0-beta0029.0.0-beta0039.0.0-beta0049.0.0-rc0019.0.19.1.09.1.0-rc0019.1.19.2.09.2.0-rc0019.2.19.2.29.3.09.3.0-rc0019.4.09.4.0-rc0019.4.19.4.29.5.09.5.0-rc0019.5.19.5.29.5.39.5.49.5.59.5.69.5.79.5.89.5.911.0.011.0.0-rc111.0.0-rc211.0.0-rc311.0.111.0.211.0.311.1.011.1.0-rc00111.1.111.1.211.1.311.2.011.2.0-rc111.2.112.0.012.0.0-rc112.0.0-rc212.0.0-rc312.0.0-rc412.0.0-rc512.1.012.1.0-rc112.1.112.1.212.2.012.2.0-rc112.2.112.2.212.2.312.2.413.0.013.0.0-rc113.0.0-rc213.0.0-rc313.0.0-rc413.0.0-rc513.0.113.0.213.1.013.1.0-rc13.1.113.1.213.2.013.2.0-rc113.2.0-rc213.2.114.0.014.0.0-beta00114.0.0-beta00214.0.0-beta00314.0.0-beta00414.0.0-rc114.0.114.0.214.1.014.1.0-rc114.1.0-rc214.1.1

Fixed in

10.5.713.2.214.1.2

References

https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-9v8m-qv22-f268
https://nvd.nist.gov/vuln/detail/CVE-2025-23041

Updated Sep 19, 2025 · Source: OSV.dev
CVE-2024-35239 GHSA-p572-p2rj-q5f4 May 28, 2024

Umbraco Forms components vulnerable to Stored Cross-site Scripting

2.7 / 10
Low
Network Low High None Unchanged Low None None

Impact

Authenticated user that has access to edit Forms may inject unsafe code into Forms components.

Patches

Issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).

References

https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024 https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024 https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values

Affected versions

13.0.012.0.012.1.012.1.0-rc112.1.112.1.212.2.012.2.0-rc112.2.110.0.010.0.110.0.2

+ 25 more Show less

10.0.310.0.410.0.510.1.010.1.0-rc00110.1.110.1.210.1.310.2.010.2.0-rc00110.2.110.2.210.2.310.2.410.3.010.3.0-rc00110.3.110.3.210.3.310.4.010.4.0-rc110.5.010.5.0-rc110.5.110.5.2

Fixed in

8.13.1310.5.312.2.213.0.1

References

https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4
https://nvd.nist.gov/vuln/detail/CVE-2024-35239
https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values
https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024
https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes
https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes#version-8

Updated Feb 03, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 9
minor 38
patch 120
pre 92

260 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More