Umbraco Forms, a form builder integrated with the Umbraco CMS, contains a path traversal flaw that allows an authenticated backoffice user to enumerate and traverse file system paths and read arbitrary files. The vulnerability exploits the export endpoint by accepting a fileName parameter that can contain traversal sequences. If exploited, an attacker can access sensitive configuration files, credentials, or other confidential data residing on the host, leading to a breach of confidentiality and potential integrity compromise.

Affected deployments are Umbraco Forms versions 16 and 17 running on Linux or macOS. The issue does not affect Umbraco Cloud users as the platform operates on Windows. Patches are available in release 16.4.1 for the 16 branch and 17.1.1 for the 17 branch. Versions prior to these are vulnerable.

The CVSS base score is 6, denoting moderate severity, and the EPSS score is less than 1 %, indicating a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. An attacker requires authenticated backoffice access and can trigger the vulnerability via the /umbraco/forms/api/v1/export endpoint by providing a malicious fileName. Based on the description, it is inferred that the likely attack vector is an authenticated backoffice user, providing an authenticated attack vector with moderate impact, warranting priority remediation.