{"metadata": {"vulnerability": "CVE-2026-73858", "count": 13, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-08-13T17:44:28.645Z", "date_only": false, "value": "2026-08-13T17:44:28.645Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-73858", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-23T14:30:22.968Z", "date_only": false, "value": "2026-09-23T14:30:22.968Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73858", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-23T14:30:22.968Z", "date_only": false, "value": "2026-09-23T14:30:22.968Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-73858", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T14:31:10Z", "date_only": false, "value": "2026-09-23T14:31:10Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-GXRG-X694-283W", "record": "GHSA-GXRG-X694-283W", "field": "published"}, {"timestamp": "2026-09-23T14:31:10Z", "date_only": false, "value": "2026-09-23T14:31:10Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-GXRG-X694-283W", "record": "GHSA-GXRG-X694-283W", "field": "modified"}, {"timestamp": "2026-09-23T15:17:18.233Z", "date_only": false, "value": "2026-09-23T15:17:18.233", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73858", "record": "FKIE_CVE-2026-73858", "field": "published"}, {"timestamp": "2026-09-23T15:20:33.646Z", "date_only": false, "value": "2026-09-23T15:20:33.646811Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-73858", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-23T15:20:33.646Z", "date_only": false, "value": "2026-09-23T15:20:33.646811Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73858", "record": "FKIE_CVE-2026-73858", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-23T15:20:58.490Z", "date_only": false, "value": "2026-09-23T15:20:58.490Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-73858", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-23T15:20:58.490Z", "date_only": false, "value": "2026-09-23T15:20:58.490Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-73858", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T15:34:03.236Z", "date_only": false, "value": "2026-09-23T15:34:03.236879Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/5d7065e19498fa7e5c333fadaf0458b2", "record": "CVE-2026-73858", "field": "creation_timestamp", "uuid": "d6f9ba13-23c2-478e-9c88-65d34a2d6659", "content": "# CVE-2026-73858: CVE-2026-73858: Server-Side Twig Template Injection in Solspace Freeform for Craft CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73858\n\n## Summary\nA technical analysis of CVE-2026-73858 / GHSA-gxrg-x694-283w, a server-side template injection vulnerability in the Solspace Freeform plugin for Craft CMS. The vulnerability permits unauthenticated users to trigger dynamic Twig evaluation of input fields during form validation re-rendering, causing local directory path disclosure and PHP runtime information exposure.\n\n## TL;DR\nUnauthenticated remote attackers can inject Twig expressions into form inputs in Solspace Freeform versions 5.x < 5.10.14. When validation fails and the form re-renders, the input values are processed by an isolated Twig instance, allowing system configuration and path disclosure.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1336\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n- **Impact**: Information Disclosure / Local Path Leakage\n\n## Affected Systems\n\n- Solspace Freeform 5.x instances running on Craft CMS 5.x\n- **Solspace Freeform**: >= 5.0.0, < 5.10.14 (Fixed in: `5.10.14`)\n\n## Mitigation\n\n- Upgrade Freeform plugin to 5.10.14 or later.\n- Deploy Web Application Firewall (WAF) rules to filter Twig dynamic symbols.\n- Perform regular dependency audits on Craft CMS plugins.\n\n**Remediation Steps:**\n1. Navigate to the Craft CMS root directory.\n2. Execute 'composer update solspace/craft-freeform' via terminal.\n3. Run 'php craft migrate/all' to apply any associated database structural migrations.\n4. Clear application caches using 'php craft clear-caches/all'.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w)\n- [Fix Commit](https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b)\n- [Developer Pull Request](https://github.com/solspace/craft-freeform/pull/1986)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-73858)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73858) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/5d7065e19498fa7e5c333fadaf0458b2"}, {"timestamp": "2026-09-23T16:35:02.584Z", "date_only": false, "value": "2026-09-23T16:35:02.584615Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w", "record": "CVE-2026-73858", "field": "creation_timestamp", "uuid": "0e5a6d63-f2e1-4d39-93f4-b149bddef720", "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w"}, {"timestamp": "2026-09-23T18:12:04.247Z", "date_only": false, "value": "2026-09-23T18:12:04.247", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73858", "record": "FKIE_CVE-2026-73858", "field": "lastModified"}]}