CVE-2021-33224

Critical · CVSS 9.8

Umbraco Forms — Unrestricted File Upload leading to Remote Code Execution (CWE-434)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-434

Description

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file.

Search profile — drives PoC discovery

Symbols web.configumbracoFormsUmbracoFormsFileUploadaspaspxuploadformsUmbraco.Forms

Keywords CVE-2021-33224Umbraco Forms file upload vulnerabilityUmbraco Forms 8.7.0 RCEUmbraco Forms unrestricted file uploadUmbraco Forms web.config bypassUmbraco Forms unauthenticated uploadUmbraco Forms arbitrary code executionCWE-434 Umbraco

Versions: 8.7.0

References

https://our.umbraco.com/packages/developer-tools/umbraco-forms
http://umbraco.com
https://our.umbraco.com/packages/developer-tools/umbraco-forms

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T06:30:39.000Z