medium5.8
CVE-2025-23041
Umbraco Forms's Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length
Impact
### Impact Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. ### Patches Patched in 8.13.16, 10.5.7, 13.2.2, 14.1.2
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Umbraco.Forms | < 10.5.7 | 10.5.7 |
| nuget | UmbracoForms | < 8.13.15 | 8.13.16 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Umbraco | Umbraco Forms | before 8.13.15 from 10.0.0 before 10.5.7 from 13.0.0 before 13.2.2 from 14.0.0 before 14.1.2 |