CVE-2025-47280

Workarounds

Unpatched or unsupported versions can workaround this issue by using the 'Send email with template (Razor)' workflow instead or writing a custom workflow type.

To avoid accidentally using the vulnerable workflow again, the SendEmail workflow type can be removed using the following composer (tested on Umbraco 10, 13, 14 and 15):

using Umbraco.Cms.Core.Composing;
using Umbraco.Forms.Core.Providers.Extensions;
using Umbraco.Forms.Core.Providers.WorkflowTypes;

internal sealed class RemoveFormsSendEmailWorkflowTypeComposer : IComposer
{
    public void Compose(IUmbracoBuilder builder)
        => builder.FormsWorkflows().Exclude<SendEmail>();
}

The 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address (potentially bypassing spam and email client security systems).

Kodem intelligence

This issue affects all (supported) versions Umbraco Forms and is patched in 13.4.2 and 15.1.2.

1. What is CVE-2025-47280? CVE-2025-47280 is a low-severity security vulnerability in Umbraco.Forms (nuget), affecting versions >= 7.0.0, < 13.4.2. It is fixed in 13.4.2, 15.1.2.
2. Which packages are affected by CVE-2025-47280?
   • Umbraco.Forms (nuget) (versions >= 7.0.0, < 13.4.2)
   • UmbracoForms (nuget) (versions >= 7.0.0, <= 8.13.16)
3. Is there a fix for CVE-2025-47280? Yes. CVE-2025-47280 is fixed in 13.4.2, 15.1.2. Upgrade to this version or later.
4. Is CVE-2025-47280 exploitable, and should I be worried? Whether CVE-2025-47280 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2025-47280 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2025-47280?
   • Upgrade Umbraco.Forms to 13.4.2 or later
   • Upgrade Umbraco.Forms to 15.1.2 or later

Other vulnerabilities in Umbraco.Forms