CVE-2025-47280

Description

Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2, the Send email workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address, potentially bypassing spam and email client security systems. This issue affects all (supported) versions Umbraco Forms and is patched in 13.4.2 and 15.1.2. Unpatched or unsupported versions can workaround this issue by using the Send email with template (Razor) workflow instead or writing a custom workflow type. To avoid accidentally using the vulnerable workflow again, the SendEmail workflow type can be removed using a composer available in the GitHub Security Advisory for this vulnerability.

Risk Information

Base Score

6.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.093

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-47280 are affected in Nuget - UmbracoForms 8.13.16	Windows
Vulnerabilities CVE-2025-47280 are fixed in Nuget - Umbraco.Forms 13.4.2	Windows
Vulnerabilities CVE-2025-47280 are fixed in Nuget - Umbraco.Forms 15.1.2	Windows
Vulnerabilities CVE-2025-47280 are affected in Nuget - UmbracoForms for Linux 8.13.16	Linux
Vulnerabilities CVE-2025-47280 are fixed in Nuget - Umbraco.Forms for Linux 13.4.2	Linux
Vulnerabilities CVE-2025-47280 are fixed in Nuget - Umbraco.Forms for Linux 15.1.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234