Umbraco.Forms Server-Side Validation Vulnerability for Character Limits in Short and Long Answer Fields

A vulnerability exists in Umbraco.Forms versions through 10.5.7 and prior to 8.13.16, allowing character limits set by editors for short and long answer fields to be validated only on the client side, with no server-side enforcement. This could lead to fields being submitted with excessive characters, potentially causing issues downstream. The vulnerability arises because the framework does not properly validate input lengths on the server, leaving room for overlong submissions that could disrupt application functionality.

Impact

Exploitation of this vulnerability could result in improper input validation, allowing users to submit responses that exceed the intended character limits. This could lead to data integrity issues or application errors, particularly if the overlong input is not handled correctly by the system.

Remediation

Users are advised to upgrade to Umbraco.Forms versions 8.13.16, 10.5.7, 13.2.2, or 14.1.2.