Vulnerability in EPiServer.Forms

Try our conversational search powered by Generative AI!

Magnus Rahl
Sep 28, 2023
(6 votes)

Vulnerability in CMS 12 shell module configuration


A potential security vulnerability has been identified in Optimizely CMS 12, triggered by a certain shell module configuration. To be vulnerable the application needs to fulfil these conditions:

  • Use EPiServer.CMS and/or EPiServer.CMS.UI.Core packages of version 12.0.0 or higher.
  • Have a module.config file in the root folder of the deployed application. Module.config files inside separate module directories/zips are not affected, only if the file is in the application root.
  • Have the clientResourceRelativePath attribute present on the <module> element in the module.config file and the clientResourceRelativePath attribute set to an empty string.

If all these conditions are met there is a potential vulnerability allowing an attacker using an authenticated account to access sensitive data in the application.


The risk of this vulnerability is high. Mitigation is in place for all DXP service customers.

Affected versions

All versions higher than 12.0.0 of EPiServer.CMS.UI.Core. Note that the project might not be referencing this package directly, but rather it being a transitive dependency of for example the EPiServer.CMS package of the same version.


The underlying issue has been fixed in CMS-30098. Update to version 12.22.8 or later of the EPiServer.CMS (or EPiServer.CMS.UI or EPiServer.CMS.UI.Core, depending on which package you reference directly) to receive this fix.

As an alternative workaround if you cannot take an update right now, edit the module.config to remove the clientResourceRelativePath completely instead of having it set to an empty string. 

Depending on the setup of the specific shell module and module.config, either of these changes might mean you also need to change the location of files in the paths referenced by the module.config, and/or change how paths to those files are resolved in the application to match.

These module files are related to editor customizations, scripts and stylesheets used in shell modules, so make sure to test such customizations. Please contact support if you run into a scenario you cannot solve.


Please contact application support at

Risk definitions

Low – little to no potential impact on Optimizely or customer environments/data. Vulnerability has low exploitability, for example: requirement for local or physical system access, zero reachability to/executability within Optimizely products/code.

Medium – some potential impact on Optimizely or customer environments/data. Vulnerability has medium exploitability, for example: requirement to be located on the same local network as the target, requirement for an individual to be manipulated via social engineering, requirement for user privileges, vulnerability achieves limited access to Optimizely products/code.

High – high potential impact on Optimizely or customer environments/data.  Vulnerability has high exploitability, for example:  achieves high level access to Optimizely products/code, could elevate privileges, could result in a significant data loss or downtime.

Critical – very significant potential impact on Optimizely or customer environments/data.  Vulnerability has very high exploitability, for example: achieves admin/root-level access to Optimizely products/code.  Vulnerability does not require any special authentication credentials/knowledge of Optimizely products/environments. 

Sep 28, 2023


Eric Oct 2, 2023 08:09 AM

Thank you for updates. Could this information also be sent to all tech-people assigned to a client DXP? Like if I have 2 customers and have access to the paas portal I get email with this information as well? Speciellay if the incident is high. I am sadly not spending that much time anymore on world :) 

Magnus Rahl
Magnus Rahl Oct 2, 2023 08:12 AM

Eric, for DXP our CSM:s will communicate directly with contacts of affected projects in the next couple of days if that hasn't happened already.

Ted Oct 4, 2023 05:52 PM

Thanks for the detailed yet to-the-point description of the vulnerability.

Please login to comment.
Latest blogs
Date property editor

The Optimizely CMS has built-in DateTime property. When editing, the Editor selects both the date and the time. Sometimes we would like to configur...

Grzegorz Wiecheć | Dec 9, 2023 | Syndicated blog

Update related content

In this article, I will show simple code that allow to replace linked content with other content selected by the Editor. When deleting content whos...

Grzegorz Wiecheć | Dec 8, 2023 | Syndicated blog

Getting Started with Optimizely SaaS Core and Next.js Integration: Content Areas and Blocks

The blog guide elaborates on improving content rendering by exploring content areas and blocks within the Optimizely CMS. It walks through setting ...

Francisco Quintanilla | Dec 8, 2023 | Syndicated blog

Maximize performance by uploading your external data to Optimizely Graph

Learn to integrate external data into Optimizely Graph for improved performance, covering data preparation, synchronization, and effective querying.

Surjit Bharath | Dec 6, 2023 | Syndicated blog