Vulnerability-Lookup

GHSA-X7M9-MWC2-G6W2

Vulnerability from github – Published: 2026-05-18 17:23 – Updated: 2026-05-18 17:23

Summary

Formie: Pre-authenticated server-side template injection in Hidden fields

Details

Impact

Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior).
Sites with public Formie forms that include at least one Hidden field with that configuration.
No CP login for the reported chain.

Patches

2.2.20, 3.1.24

Workarounds

Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible
Otherwise, upgrade to patched versions

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "verbb/formie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-beta.1"
            },
            {
              "fixed": "3.1.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "verbb/formie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45697"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-693",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T17:23:39Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\n- Unauthenticated users could submit crafted values into Hidden fields (with Default value \u2192 Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior).\n- Sites with public Formie forms that include at least one Hidden field with that configuration.\n- No CP login for the reported chain.\n\n### Patches\n- [2.2.20](https://github.com/verbb/formie/releases/tag/2.2.20), [3.1.24](https://github.com/verbb/formie/releases/tag/3.1.24)\n\n### Workarounds\n- Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible\n- Otherwise, upgrade to patched versions",
  "id": "GHSA-x7m9-mwc2-g6w2",
  "modified": "2026-05-18T17:23:39Z",
  "published": "2026-05-18T17:23:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/verbb/formie"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/releases/tag/2.2.20"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/releases/tag/3.1.24"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Formie: Pre-authenticated server-side template injection in Hidden fields"
}

CVE-2026-45697 (GCVE-0-2026-45697)

Vulnerability from cvelistv5 – Published: 2026-05-29 19:01 – Updated: 2026-06-01 15:18

Title

Formie: Pre-authenticated server-side template injection in Hidden fields

Summary

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-693 - Protection Mechanism Failure
CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/verbb/formie/security/advisori…	x_refsource_CONFIRM
https://github.com/verbb/formie/commit/f690d56231…	x_refsource_MISC
https://github.com/verbb/formie/releases/tag/2.2.20	x_refsource_MISC
https://github.com/verbb/formie/releases/tag/3.1.24	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
verbb	formie	Affected: < 2.2.20 Affected: >= 3.0.0-beta.1, < 3.1.24

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45697",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T15:18:36.758634Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T15:18:51.317Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "formie",
          "vendor": "verbb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0-beta.1, \u003c 3.1.24"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value \u2192 Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T19:01:49.220Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2"
        },
        {
          "name": "https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3"
        },
        {
          "name": "https://github.com/verbb/formie/releases/tag/2.2.20",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/verbb/formie/releases/tag/2.2.20"
        },
        {
          "name": "https://github.com/verbb/formie/releases/tag/3.1.24",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/verbb/formie/releases/tag/3.1.24"
        }
      ],
      "source": {
        "advisory": "GHSA-x7m9-mwc2-g6w2",
        "discovery": "UNKNOWN"
      },
      "title": "Formie: Pre-authenticated server-side template injection in Hidden fields"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45697",
    "datePublished": "2026-05-29T19:01:49.220Z",
    "dateReserved": "2026-05-13T04:38:01.165Z",
    "dateUpdated": "2026-06-01T15:18:51.317Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted