CVE-2025-47280
Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow
Impact
### Impact The 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address (potentially bypassing spam and email client security systems). ### Patches This issue affects all (supported) versions Umbraco Forms and is patched in 13.4.2 and 15.1.2. ### Workarounds Unpatched or unsupported versions can workaround this issue by using the 'Send email with template (Razor)' workflow instead or [writing a custom workflow type](https://docs.umbraco.com/umbraco-forms/developer/extending/adding-a-workflowtype). To avoid accidentally using the vulnerable workflow again, the `SendEmail` workflow type can be removed using the following composer (tested on Umbraco 10, 13, 14 and 15): ```c# using Umbraco.Cms.Core.Composing; using Umbraco.Forms.Core.Providers.Extensions; using Umbraco.Forms.Core.Providers.WorkflowTypes; internal sealed class RemoveFormsSendEmailWorkflowTypeComposer : IComposer { public void Compose(IUmbracoBuilder builder) => builder.FormsWorkflows().Exclude<SendEmail>(); } ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Umbraco.Forms | >= 7.0.0, < 13.4.2 | 13.4.2 |
| nuget | UmbracoForms | >= 7.0.0, <= 8.13.16 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Umbraco | Umbraco Forms | from 7.0.0 before 13.4.2 from 14.0.0 before 15.1.2 |