GitHub Advisoryadvisory · Packagist

GHSA-9hp3-f5g8-rccg The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability

CRITICAL Published 2025-08-27 Modified 2025-08-27 Official page ↗
Aliases
CVE-2025-52122
Ecosystem
Packagist
Packages
solspace/craft-freeform
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2025-08-27

Affected packages

• Packagist solspace/craft-freeform: >= 5.0.0, < 5.10.16 → fixed in 5.10.16

Description

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).

Related

Alias · CVE (1)

  • CVE-2025-52122 Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References