GitHub Advisoryadvisory · Packagist

GHSA-vf6x-59hh-332f Formwork has a cross-site scripting (XSS) vulnerability in Site title

MEDIUM Published 2025-03-01 Modified 2026-02-18 Official page ↗
Ecosystem
Packagist
Packages
getformwork/formwork
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-80
Reviewed
2025-03-01

Affected packages

• Packagist getformwork/formwork: >= 2.0.0-beta.3, < 2.0.0-beta.4 → fixed in 2.0.0-beta.4

Description

Summary The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users. Impact The attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability. Patches • Formwork 2.x (aa3e9c6) escapes site title from panel header navigation. Details By embedding "<!--", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.

Related

Weakness · CWE (1)

  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References