GHSA-7jxj-rpx7-ph2c: Umbraco.Forms Umbraco.Forms CDN May Cache Sensitive Vulnerability
LOWGHSA-7jxj-rpx7-ph2c is a LOW (CVSS 3.1) umbraco.forms cdn may cache sensitive vulnerability (CWE-524: Use of Cache Containing Sensitive Information) affecting Umbraco.Forms libraries in the NuGet ecosystem. The issue involves umbraco.forms cdn may cache sensitive form uploads when processed by imagesharp. Remediation is available by upgrading affected packages to version 13.9.0, 16.4.0, 17.1.0.
GHSA-7jxj-rpx7-ph2c at a Glance
Security Impact
CVSS: 3.1
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
How to Fix GHSA-7jxj-rpx7-ph2c
To remediate this vulnerability, upgrade all affected Umbraco.Forms dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade Umbraco.Forms to 13.9.0Upgrade Umbraco.Forms to 16.4.0Upgrade Umbraco.Forms to 17.1.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for Umbraco.FormsHow to Check if You Are Affected
To determine whether your application is affected by GHSA-7jxj-rpx7-ph2c, inspect your project dependencies for Umbraco.Forms:
inspect dependencies for Umbraco.FormsAnalyze the terminal output to locate any version of Umbraco.Forms in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 13.9.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-524: Use of Cache Containing Sensitive Information, where the code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere. In Umbraco.Forms, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-7jxj-rpx7-ph2c Affected Umbraco.Forms Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
Umbraco.Forms
|
NuGet |
< 13.9.0
|
13.9.0
|
|
Umbraco.Forms
|
NuGet |
≥ 14.0.0-beta001
< 16.4.0
|
16.4.0
|
|
Umbraco.Forms
|
NuGet |
≥ 17.0.0-rc1
< 17.1.0
|
17.1.0
|
References
Frequently Asked Questions
What is GHSA-7jxj-rpx7-ph2c?
Which Umbraco.Forms versions are affected?
What version fixes GHSA-7jxj-rpx7-ph2c?
Is Umbraco.Forms affected?
What is the CVSS score of GHSA-7jxj-rpx7-ph2c?
What CWE is associated with GHSA-7jxj-rpx7-ph2c?
How can I check NuGet dependencies for GHSA-7jxj-rpx7-ph2c?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-7jxj-rpx7-ph2c",
"modified" : "2026-01-22T18:06:01Z",
"published" : "2026-01-22T18:06:01Z",
"aliases" : [ ],
"summary" : "Umbraco.Forms CDN may cache sensitive form uploads when processed by ImageSharp",
"details" : "### Impact\nProtected files uploaded through Umbraco Forms may be served to unauthenticated users when a CDN or caching layer is present and ImageSharp processes the request. ImageSharp sets aggressive cache headers by default, which can cause intermediary caches to store and serve files that should require authentication.\n\n### Patches\nThis issue affects all (supported) versions Umbraco Forms and is patched in 13.9.0, 16.4.0 and 17.1.0.\n\n### Workarounds\nAdd middleware to set cache headers for form uploads. Place the following code in your `Startup.cs` or `Program.cs` after `app.UseStaticFiles()` and any image processing middleware:\n\n```cs\napp.Use(async (context, next) =>\n{\n var path = context.Request.Path.Value;\n\n if (!string.IsNullOrEmpty(path) && path.StartsWith(\"/media/forms/upload/\", StringComparison.OrdinalIgnoreCase))\n {\n context.Response.OnStarting(() =>\n {\n context.Response.Headers[\"Cache-Control\"] = \"private, no-store, no-cache, must-revalidate\";\n context.Response.Headers[\"Pragma\"] = \"no-cache\";\n context.Response.Headers[\"Expires\"] = \"0\";\n return Task.CompletedTask;\n });\n }\n\n await next();\n});\n```\n\nAlternatively, configure your CDN to bypass caching for URLs matching `/media/forms/upload/*`.\n\n Note: The vulnerability requires:\n - A CDN in front of the website\n - An authenticated user having previously requested the image\n - Knowledge of the form GUID, entry GUID, and image filename\n\n If no CDN is in use, this vulnerability does not apply.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "NuGet",
"name" : "Umbraco.Forms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "13.9.0"
} ]
} ]
}, {
"package" : {
"ecosystem" : "NuGet",
"name" : "Umbraco.Forms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "14.0.0-beta001"
}, {
"fixed" : "16.4.0"
} ]
} ]
}, {
"package" : {
"ecosystem" : "NuGet",
"name" : "Umbraco.Forms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "17.0.0-rc1"
}, {
"fixed" : "17.1.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-7jxj-rpx7-ph2c"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/umbraco/Umbraco.Forms.Issues"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-524" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2026-01-22T18:06:01Z",
"nvd_published_at" : null
}
}