CVE-2026-24687

Workarounds

If upgrading is not immediately possible, users can mitigate this vulnerability by:

• Configuring a WAF or reverse proxy to block requests containing path traversal sequences (../, ..\) in the fileName parameter of the export endpoint
• Restricting network access to the Umbraco backoffice to trusted IP ranges
• Blocking the /umbraco/forms/api/v1/export endpoint entirely if the export feature is not required

However, upgrading to the patched version is strongly recommended.

References

Credit to Kevin Joensen from Baldur Security for finding this vulnerability

It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Kodem intelligence

This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1

1. What is CVE-2026-24687? CVE-2026-24687 is a medium-severity path traversal vulnerability in Umbraco.Forms (nuget), affecting versions >= 16.0.0, < 16.4.1. It is fixed in 16.4.1, 17.1.1. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. Which versions of Umbraco.Forms are affected by CVE-2026-24687? Umbraco.Forms (nuget) versions >= 16.0.0, < 16.4.1 is affected.
3. Is there a fix for CVE-2026-24687? Yes. CVE-2026-24687 is fixed in 16.4.1, 17.1.1. Upgrade to this version or later.
4. Is CVE-2026-24687 exploitable, and should I be worried? Whether CVE-2026-24687 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-24687 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-24687?
   • Upgrade Umbraco.Forms to 16.4.1 or later
   • Upgrade Umbraco.Forms to 17.1.1 or later

Other vulnerabilities in Umbraco.Forms