CVE-2021-33224

CriticalCVSS 9.8

Published: 24/02/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.73%

50th percentile - higher than 50% of all known CVEs

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file.

An attacker can take over the server, steal data, or install malware without needing any account in the system.

Immediately update Umbraco Forms to the latest version and implement file upload validation and type restrictions.

Original NVD description (English source)

File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file.