CVE-2021-33224: Umbraco Forms

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file.

Affected products

• Umbraco Umbraco Forms: version 8.7.0 only

Published 2023-02-24. Last modified 2026-07-09.