Vulnerability-Lookup

CVE-2026-73858 (GCVE-0-2026-73858)

Vulnerability from cvelistv5 – Published: 2026-09-23 14:30 – Updated: 2026-09-23 15:20

Title

Solspace Freeform: Limited Twig template injection via submitted field values

Summary

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 15:20 UTC

CWE

CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/solspace/craft-freeform/securi…	x_refsource_CONFIRM
https://github.com/solspace/craft-freeform/pull/1986	x_refsource_MISC
https://github.com/solspace/craft-freeform/commit…	x_refsource_MISC
https://github.com/solspace/craft-freeform/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
solspace	craft-freeform	Affected: >= 5.0.0, < 5.10.14	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73858",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T15:20:33.646811Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T15:20:58.490Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "craft-freeform",
          "vendor": "solspace",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.10.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:30:22.968Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w"
        },
        {
          "name": "https://github.com/solspace/craft-freeform/pull/1986",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/solspace/craft-freeform/pull/1986"
        },
        {
          "name": "https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b"
        },
        {
          "name": "https://github.com/solspace/craft-freeform/releases/tag/v5.10.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/solspace/craft-freeform/releases/tag/v5.10.14"
        }
      ],
      "source": {
        "advisory": "GHSA-gxrg-x694-283w",
        "discovery": "UNKNOWN"
      },
      "title": "Solspace Freeform: Limited Twig template injection via submitted field values"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73858",
    "datePublished": "2026-09-23T14:30:22.968Z",
    "dateReserved": "2026-08-13T17:44:28.645Z",
    "dateUpdated": "2026-09-23T15:20:58.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73858",
      "date": "2026-09-24",
      "epss": "0.0043",
      "percentile": "0.3447"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "craft-freeform",
                "vendor": "solspace",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 5.0.0, \u003c 5.10.14"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14."
          }
        ],
        "id": "CVE-2026-73858",
        "lastModified": "2026-09-23T18:12:04.247",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-73858",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T15:20:33.646811Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-23T15:17:18.233",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/solspace/craft-freeform/pull/1986"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/solspace/craft-freeform/releases/tag/v5.10.14"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1336"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73858",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-23T15:20:33.646811Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-23T15:20:51.207Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "craft-freeform",
              "vendor": "solspace",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 5.0.0, \u003c 5.10.14"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1336",
                  "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-23T14:30:22.968Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w"
            },
            {
              "name": "https://github.com/solspace/craft-freeform/pull/1986",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/solspace/craft-freeform/pull/1986"
            },
            {
              "name": "https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b"
            },
            {
              "name": "https://github.com/solspace/craft-freeform/releases/tag/v5.10.14",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/solspace/craft-freeform/releases/tag/v5.10.14"
            }
          ],
          "source": {
            "advisory": "GHSA-gxrg-x694-283w",
            "discovery": "UNKNOWN"
          },
          "title": "Solspace Freeform: Limited Twig template injection via submitted field values"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-73858",
        "datePublished": "2026-09-23T14:30:22.968Z",
        "dateReserved": "2026-08-13T17:44:28.645Z",
        "dateUpdated": "2026-09-23T15:20:58.490Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-73858

Vulnerability from fkie_nvd - Published: 2026-09-23 15:17 - Updated: 2026-09-23 18:12

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b
	security-advisories@github.com	https://github.com/solspace/craft-freeform/pull/1986
	security-advisories@github.com	https://github.com/solspace/craft-freeform/releases/tag/v5.10.14
	security-advisories@github.com	https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "craft-freeform",
          "vendor": "solspace",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.10.14"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14."
    }
  ],
  "id": "CVE-2026-73858",
  "lastModified": "2026-09-23T18:12:04.247",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73858",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-23T15:20:33.646811Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-23T15:17:18.233",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/solspace/craft-freeform/pull/1986"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/solspace/craft-freeform/releases/tag/v5.10.14"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GXRG-X694-283W

Vulnerability from github – Published: 2026-09-23 14:31 – Updated: 2026-09-23 14:31

Summary

Solspace Freeform: Limited Twig template injection via submitted field values

Details

Summary

A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts.

Unauthenticated users could submit Twig expressions through public Freeform forms and have those expressions evaluated when the submitted values were rendered back into the form response. Confirmed impact includes disclosure of limited server/environment information, such as the PHP version and absolute filesystem paths.

No evidence was found that this issue allowed access to Craft globals, environment variables, database credentials, mailer credentials, security keys, or remote code execution in the tested environment.

Details

Plugin: Solspace Freeform Affected versions: Freeform 5.0.0 through 5.10.13 CMS: Craft CMS Authentication required: None Attack vector: Public Freeform form submission

Submitted field values were passed through Freeform’s isolated Twig renderer. As a result, Twig expressions included in submitted values could be evaluated server-side and reflected in the HTTP response.

The isolated Twig context appears to limit the available functions and globals. Confirmed accessible values were limited to PHP/core constants and Craft bootstrap constants such as:

{{ constant('PHP_VERSION') }}
{{ constant('PHP_OS') }}
{{ constant('CRAFT_BASE_PATH') }}
{{ constant('CRAFT_VENDOR_PATH') }}

Testing did not confirm access to:

craft
craft.app
alias()
getenv()
database credentials
mailer credentials
Craft security key
Craft license key
environment variables

Proof of Concept

Submit a public Freeform form.
Inject the following payload into an email field:

{{ constant('PHP_VERSION') }}@example.com

The response may reflect the evaluated PHP version, for example:

value="8.2.27@example.com"

Inject the following payload into a text field:

{{ constant('CRAFT_VENDOR_PATH') }}

The response may reflect the absolute vendor path, for example:

/var/www/example-site/production/vendor/

Impact

An unauthenticated attacker with access to a public Freeform form could cause limited Twig expressions to be evaluated server-side.

Confirmed impact includes:

PHP version disclosure
Operating system/platform disclosure
Absolute filesystem path disclosure
Potential form rendering errors from malformed Twig input

This could assist with environment fingerprinting or be used in combination with other vulnerabilities. However, no credential disclosure, Craft application access, arbitrary file read, or remote code execution was confirmed.

Remediation

Freeform should treat submitted field values as plain user input and should not evaluate them as Twig. Twig rendering should be limited to trusted/admin-authored templates and configuration values.

This issue has been resolved by preventing submitted field values from being rendered as Twig in the affected context.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.10.13"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "solspace/craft-freeform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.10.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73858"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T14:31:10Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts.\n\nUnauthenticated users could submit Twig expressions through public Freeform forms and have those expressions evaluated when the submitted values were rendered back into the form response. Confirmed impact includes disclosure of limited server/environment information, such as the PHP version and absolute filesystem paths.\n\nNo evidence was found that this issue allowed access to Craft globals, environment variables, database credentials, mailer credentials, security keys, or remote code execution in the tested environment.\n\n### Details\n\n**Plugin:** Solspace Freeform\n**Affected versions:** Freeform 5.0.0 through 5.10.13\n**CMS:** Craft CMS\n**Authentication required:** None\n**Attack vector:** Public Freeform form submission\n\nSubmitted field values were passed through Freeform\u2019s isolated Twig renderer. As a result, Twig expressions included in submitted values could be evaluated server-side and reflected in the HTTP response.\n\nThe isolated Twig context appears to limit the available functions and globals. Confirmed accessible values were limited to PHP/core constants and Craft bootstrap constants such as:\n\n```twig\n{{ constant(\u0027PHP_VERSION\u0027) }}\n{{ constant(\u0027PHP_OS\u0027) }}\n{{ constant(\u0027CRAFT_BASE_PATH\u0027) }}\n{{ constant(\u0027CRAFT_VENDOR_PATH\u0027) }}\n```\n\nTesting did not confirm access to:\n\n```text\ncraft\ncraft.app\nalias()\ngetenv()\ndatabase credentials\nmailer credentials\nCraft security key\nCraft license key\nenvironment variables\n```\n\n### Proof of Concept\n\n1. Submit a public Freeform form.\n\n2. Inject the following payload into an email field:\n\n```twig\n{{ constant(\u0027PHP_VERSION\u0027) }}@example.com\n```\n\nThe response may reflect the evaluated PHP version, for example:\n\n```html\nvalue=\"8.2.27@example.com\"\n```\n\n3. Inject the following payload into a text field:\n\n```twig\n{{ constant(\u0027CRAFT_VENDOR_PATH\u0027) }}\n```\n\nThe response may reflect the absolute vendor path, for example:\n\n```text\n/var/www/example-site/production/vendor/\n```\n\n### Impact\n\nAn unauthenticated attacker with access to a public Freeform form could cause limited Twig expressions to be evaluated server-side.\n\nConfirmed impact includes:\n\n```text\nPHP version disclosure\nOperating system/platform disclosure\nAbsolute filesystem path disclosure\nPotential form rendering errors from malformed Twig input\n```\n\nThis could assist with environment fingerprinting or be used in combination with other vulnerabilities. However, no credential disclosure, Craft application access, arbitrary file read, or remote code execution was confirmed.\n\n### Remediation\n\nFreeform should treat submitted field values as plain user input and should not evaluate them as Twig. Twig rendering should be limited to trusted/admin-authored templates and configuration values.\n\nThis issue has been resolved by preventing submitted field values from being rendered as Twig in the affected context.",
  "id": "GHSA-gxrg-x694-283w",
  "modified": "2026-09-23T14:31:10Z",
  "published": "2026-09-23T14:31:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/solspace/craft-freeform/pull/1986"
    },
    {
      "type": "WEB",
      "url": "https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/solspace/craft-freeform"
    },
    {
      "type": "WEB",
      "url": "https://github.com/solspace/craft-freeform/releases/tag/v5.10.14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Solspace Freeform: Limited Twig template injection via submitted field values"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73858 (GCVE-0-2026-73858)

FKIE_CVE-2026-73858

GHSA-GXRG-X694-283W

Summary

Details

Proof of Concept

Impact

Remediation

Tags

Sightings

Nomenclature

Related by attack behaviour