GHSA-hm5p-82g6-m3xh
Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac
Quick fix
GHSA-hm5p-82g6-m3xh — Umbraco.Forms: upgrade to the fixed version with the command below.
dotnet add package Umbraco.Forms --version 16.4.1Details
### Impact It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected.
### Patches This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1
### Workarounds If upgrading is not immediately possible, users can mitigate this vulnerability by: * Configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\`) in the `fileName` parameter of the export endpoint * Restricting network access to the Umbraco backoffice to trusted IP ranges * Blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required
However, upgrading to the patched version is strongly recommended.
### References Credit to Kevin Joensen from Baldur Security for finding this vulnerability
Are you affected?
Enter the version of the package you're using.
Affected packages
16.0.0Fixed in: 16.4.1dotnet add package Umbraco.Forms --version 16.4.117.0.0Fixed in: 17.1.1dotnet add package Umbraco.Forms --version 17.1.1