Umbraco Forms's Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length

GHSA-9v8m-qv22-f268 · CVE-2025-23041

Published Jan 14, 2025 · Modified Sep 19, 2025

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

Character limits configured by editors for short and long answer fields are validated only client-side, not server-side.

Patches

Patched in 8.13.16, 10.5.7, 13.2.2, 14.1.2

References

WEB https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-9v8m-qv22-f268
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-23041

5.8 / 10

MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes