CVE-2025-47280 json
Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow
published 2025-05-13 17 mo ago modified 2026-06-17 4 mo ago also GHSA-2qrj-g9hq-chph , EUVD-2025-14405
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2, the 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address, potentially bypassing spam and email client security systems. This issue affects all (supported) versions Umbraco Forms and is patched in 13.4.2 and 15.1.2. Unpatched or unsupported versions can workaround this issue by using the `Send email with template (Razor)` workflow instead or writing a custom workflow type. To avoid accidentally using the vulnerable workflow again, the `SendEmail` workflow type can be removed using a composer available in the GitHub Security Advisory for this vulnerability.
Patch / fix
- nuget Umbraco.Forms 13.4.2, 15.1.2
- umbraco umbraco_forms 13.4.2, 15.1.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-2qrj-g9hq-chph referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:U |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 0.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Umbraco.Forms | >=7.0.0, <13.4.2 >=14.0.0, <15.1.2 |
13.4.2 15.1.2 |
| nuget | UmbracoForms | >=7.0.0, <=8.13.16 |
no fix listed |
Affected products
- umbraco Umbraco.Forms.Issues
Classification
- Weakness
-
- CWE-116 Improper Encoding or Escaping of Output
References
-
github.com
/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-2qrj-g9hq-chph
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-47280
advisory
-
github.com
/umbraco/Umbraco.Forms.Issues
package
Sources
- CVE List CVE-2025-47280
- GitHub Advisory GHSA-2qrj-g9hq-chph
- NVD CVE-2025-47280
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.