CVE-2025-47280: Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow

May 13, 2025

The ‘Send email’ workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address (potentially bypassing spam and email client security systems).

References

github.com/advisories/GHSA-2qrj-g9hq-chph
github.com/umbraco/Umbraco.Forms.Issues
github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-2qrj-g9hq-chph
nvd.nist.gov/vuln/detail/CVE-2025-47280

Code Behaviors & Features

Detect and mitigate CVE-2025-47280 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →