Skip to main content

Umbraco Forms CVE-2020-7685

HIGH
Initialization of a Resource with an Insecure Default (CWE-1188)
2020-07-28 report@snyk.io
Information Disclosure Umbraco Forms
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 28, 2020 - 17:15 nvd
HIGH 7.5

DescriptionNVD

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.

AnalysisAI

This affects all versions of package UmbracoForms. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1188. This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies. Affected products include: Umbraco Umbraco Forms.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Umbraco Forms

View all
CVE-2021-33224 CRITICAL
9.8 Feb 24

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a craf
CVE-2025-68924 HIGH
7.5 Jan 16

Umbraco Forms versions up to 8.13.16 is affected by inclusion of functionality from untrusted control sphere (CVSS 7.5).
CVE-2026-24687 MEDIUM
6.5 Jan 29

Authenticated users in Umbraco Forms versions 16 and 17 can exploit a path traversal vulnerability to read arbitrary fil
CVE-2025-47280 LOW POC
2.3 May 13

Umbraco Forms is a form builder that integrates with the Umbraco content management system. Rated low severity (CVSS 2.3
CVE-2024-35239 MEDIUM
5.4 May 28

Umbraco Commerce is an open source dotnet web forms solution. Rated medium severity (CVSS 5.4), this vulnerability is re
CVE-2025-23041 MEDIUM
5.8 Jan 14

Umbraco.Forms is a web form framework written for the nuget ecosystem. Rated medium severity (CVSS 5.8), this vulnerabil

Same weakness CWE-1188 – Initialization of a Resource with an Insecure Default

View all
CVE-2017-4971 MEDIUM
5.9
CVE-2023-27524 CRITICAL POC
9.8
CVE-2022-24706 CRITICAL POC
9.8
CVE-2017-7964 CRITICAL POC
10.0
CVE-2017-8218 CRITICAL POC
9.8
CVE-2026-28775 CRITICAL POC
9.8
CVE-2025-70998 CRITICAL POC
9.8
CVE-2021-42109 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2020-7685 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy