Listen to this Post
The vulnerability exists within the file export API endpoint (/umbraco/forms/api/v1/export). An authenticated user with backoffice access can submit export requests. The endpoint accepts a `fileName` parameter to specify the export destination. Insufficient input validation and sanitization of this parameter allows an attacker to inject path traversal sequences (e.g., ../../../etc/passwd). On Linux and macOS installations, the application, running with the permissions of the web server process, uses this user-controlled input to construct filesystem paths. This flaw permits reading the contents of arbitrary files outside the intended web root directory. By manipulating the `fileName` parameter iteratively, an attacker can also enumerate directory structures to map the filesystem and locate sensitive configuration files, source code, or environment data stored on the server.
Platform: Umbraco Forms
Version: 16.0.0-16.4.1
Vulnerability: Path Traversal
Severity: Moderate
Date: 2026-01-30
Prediction: Patched Available
What Undercode Say:
Analytics:
curl -k -H "Authorization: Bearer [bash]" "https://target/umbraco/forms/api/v1/export?fileName=../../../etc/passwd"
for i in $(cat wordlist.txt); do echo "[] Trying $i"; curl -s -k -H "Authorization: Bearer [bash]" "https://target/umbraco/forms/api/v1/export?fileName=../../../$i" | head -c1; done
// Vulnerable parameter usage in export endpoint var filePath = Path.Combine(rootPath, userFileName); // Inadequate validation
Exploit:
1. Acquire backoffice authentication.
2. Craft malicious export request.
3. Inject directory traversal sequences.
4. Retrieve sensitive file contents.
5. Enumerate system paths iteratively.
Protection from this CVE:
1. Upgrade immediately.
2. Apply input sanitization.
3. Use strict allowlisting.
4. Restrict server permissions.
5. Disable unused endpoints.
Impact:
Unauthorized file read.
Information disclosure.
System mapping potential.
Affects Linux/Mac.
Authenticated attack vector.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
