CVE-2024-35239 Stored Cross-site Scripting on Components of Umbraco Forms
Authenticated users can inject unsafe HTML into Umbraco Forms components, enabling stored XSS attacks unless unsafe rendering is disabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35239?
CVE-2024-35239 is a low-severity cross-site scripting vulnerability in Umbraco.Forms.Issues, published on 28 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
Weakness: CWE-79
Which versions are affected by CVE-2024-35239?
8 open source packages ship an affected version, including Umbraco.Forms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Umbraco.Forms NuGet | From 10.0.0 | 10.5.3 |
Umbraco.Forms NuGet | From 10.0.0 | 10.5.3 |
Umbraco.Forms NuGet | From 12.0.0 | 12.2.2 |
Umbraco.Forms NuGet | From 12.0.0 | 12.2.2 |
Umbraco.Forms NuGet | From 13.0.0 | 13.0.1 |
Umbraco.Forms NuGet | From 13.0.0 | 13.0.1 |
2 more packages
Umbraco.Forms NuGet | From 8.0.0 | 8.13.13 |
Umbraco.Forms NuGet | From 8.0.0 | 8.13.13 |
Products include Umbraco Umbraco Forms.
How do I fix CVE-2024-35239?
Upgrade Umbraco.Forms to a fixed version for your release line: 10.5.3, 12.2.2, 13.0.1 or 8.13.13.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-35239 being exploited?
There is no known exploitation of CVE-2024-35239 in the wild and no public exploit code.
Other vulnerabilities in Umbraco.Forms.Issues
- CVE-2021-33224 File upload in n/a
- CVE-2025-68924 UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation
- CVE-2026-24687 Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac
- CVE-2025-23041 Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms
- CVE-2020-7685 Insecure Defaults
Sources
Also known as GHSA-p572-p2rj-q5f4.