CVE-2020-7685
Insecure Defaults
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Insecure Defaults
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
- Record
CVE-2020-7685- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
EUVDEUVD-2020-0545
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
- Record
EUVD-2020-0545- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8m73-w2r2-6xxj
Insecure defaults in UmbracoForms
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
- Record
GHSA-8m73-w2r2-6xxj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
NVD
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
- Record
CVE-2020-7685- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
OSVGHSA-8m73-w2r2-6xxj
Insecure defaults in UmbracoForms
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
- Record
GHSA-8m73-w2r2-6xxj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
UmbracoFormsNuGet |
through 8.4.1 | None known |
UmbracoFormsNuGet |
through 8.4.1, plus listed versions 4.0.04.0.14.0.1-Build1114.0.24.0.3 Show 45 moreShow less4.1.04.1.14.1.24.1.34.1.44.1.54.1.64.2.14.2.24.3.04.3.0-beta4.3.14.3.24.3.34.4.04.4.14.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.96.0.06.0.16.0.106.0.26.0.36.0.46.0.56.0.66.0.76.0.86.0.97.0.07.0.17.0.27.0.37.0.47.0.57.0.67.0.77.1.07.1.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7685 is a medium vulnerability (CVSS 5.4) in Umbraco Forms, published July 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. No source names a fixed version.
References
Left out here: 43 versions. The JSON record has them.