Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac

Vulnerability

Overview CVE-2026-24687 is a path traversal vulnerability in Umbraco Forms, a form builder for the Umbraco CMS. The issue resides in the export endpoint (/umbraco/forms/api/v1/export), which does not properly sanitize the fileName parameter, allowing authenticated backoffice users to traverse directories and read arbitrary files on the system filesystem [1][3].

Exploitation

Conditions An attacker must be an authenticated backoffice user with access to the export functionality. By crafting requests containing path traversal sequences (../ or ..\) in the fileName parameter, they can enumerate and read files outside the intended directory. The vulnerability is only exploitable on Mac or Linux installations; Umbraco Cloud runs on Windows and is not affected [1][3].

Impact

Successful exploitation enables an attacker to read sensitive files, such as configuration files or source code, potentially leading to further compromise. The attacker gains unauthorized read access to the file system, which can expose credentials, secrets, or other critical data [1][3].

Mitigation

The vulnerability is patched in Umbraco Forms versions 16.4.1 and 17.1.1. If immediate upgrade is not possible, mitigations include configuring a WAF or reverse proxy to block path traversal sequences in the fileName parameter, restricting network access to the backoffice, or disabling the export endpoint entirely. However, upgrading is strongly recommended [1][3].