High severity · published Jul 28, 2020
CVE-2020-7685
This affects all versions of package UmbracoForms
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UF
Umbraco Forms · Umbraco
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7685
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7685
Third Party Advisory
https://snyk.io/vuln/SNYK-DOTNET-UMBRACOFORMS-595765
More from Umbraco Forms
9.8
CVE-2021-33224
File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file
7.5
CVE-2025-68924
In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution
6.5
CVE-2026-24687
Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac
6.1
CVE-2025-47280
Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow
5.4
CVE-2024-35239
Umbraco Commerce is an open source dotnet web forms solution