CVEvulnerability

CVE-2026-45697

9.8 CRITICAL Published 2026-05-29 Modified 2026-07-22 Official page ↗

Status: Deferred
Published: 2026-05-29
Last modified: 2026-07-22
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-1336, CWE-693, CWE-94

Description

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.

Weakness · CWE (3)

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness
CWE-693 Protection Mechanism Failure weakness
CWE-94 Improper Control of Generation of Code weakness

References

https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3 github.com
https://github.com/verbb/formie/releases/tag/2.2.20 github.com
https://github.com/verbb/formie/releases/tag/3.1.24 github.com
https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2 github.com

CVE-2026-45697

Description

Related

Weakness · CWE (3)

References