CVE-2026-24687
Unknown Unknown - Not Provided
Path Traversal in Umbraco Forms Allows Authenticated File Access

Publication date: 2026-01-29

Last updated on: 2026-03-02

Assigner: GitHub, Inc.

Description
Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1. If upgrading is not immediately possible, users can mitigate this vulnerability by configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\`) in the `fileName` parameter of the export endpoint, restricting network access to the Umbraco backoffice to trusted IP ranges, and/or blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required. However, upgrading to the patched version is strongly recommended.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-29
Last Modified
2026-03-02
Generated
2026-06-16
AI Q&A
2026-01-29
EPSS Evaluated
2026-06-15
NVD
CVE-2026-24687
EUVD
EUVD-2026-4966
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
umbraco umbraco_forms From 16.0.0 (inc) to 16.4.1 (exc)
umbraco umbraco_forms From 17.0.0 (inc) to 17.1.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-24687 is a path traversal and file enumeration vulnerability in Umbraco Forms versions prior to 16.4.1 and 17.1.1 on Mac and Linux systems. It allows an authenticated backoffice user to traverse directories and enumerate files on the system's filesystem, reading their contents. This happens because the software does not properly sanitize input used to build file paths, allowing special path elements like "../" to access files outside the intended directories. [1]

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive file contents on the server where Umbraco Forms is installed. An authenticated backoffice user could read files they should not have access to, potentially exposing confidential information. However, it does not affect system integrity or availability, and it does not impact Umbraco Cloud users running on Windows. [1]

Detection Guidance

Detection can focus on monitoring requests to the /umbraco/forms/api/v1/export endpoint for path traversal patterns in the fileName parameter, such as '../' or '..\'. Network or web server logs can be searched for these patterns. For example, using grep on access logs: grep -E 'fileName=.*(\.\./|\.\.\\)' access.log. Additionally, monitoring authenticated backoffice user activity for unusual export requests may help detect exploitation attempts. [1]

Mitigation Strategies

Immediate mitigation steps include: 1) Upgrading Umbraco Forms to patched versions 16.4.1 or 17.1.1. 2) If upgrading is not possible immediately, configure a Web Application Firewall (WAF) or reverse proxy to block requests containing path traversal sequences ('../' or '..\') in the fileName parameter of the export API endpoint. 3) Restrict network access to the Umbraco backoffice to trusted IP ranges. 4) Block the /umbraco/forms/api/v1/export endpoint entirely if the export feature is not required. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24687. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart