GitHub Advisoryadvisory · Packagist

GHSA-2xm2-23ff-p8ww Formie has XSS vulnerability for email notification content for preview

MEDIUM Published 2025-04-11 Modified 2025-04-11 Official page ↗
Aliases
CVE-2025-32426
Ecosystem
Packagist
Packages
verbb/formie
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-04-11

Affected packages

• Packagist verbb/formie: < 2.1.44 → fixed in 2.1.44

Description

Impact It is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered email). This would require access to the form's email notification settings. Patches This has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.

Related

Alias · CVE (1)

  • CVE-2025-32426 Formie is a Craft CMS plugin for creating forms. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References