GitHub Advisoryadvisory · Packagist

GHSA-x7m9-mwc2-g6w2 Formie: Pre-authenticated server-side template injection in Hidden fields

CRITICAL Published 2026-05-18 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-45697
Ecosystem
Packagist
Packages
verbb/formie
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1336, CWE-693, CWE-94
Reviewed
2026-05-18

Affected packages

• Packagist verbb/formie: >= 3.0.0-beta.1, < 3.1.24 → fixed in 3.1.24 • Packagist verbb/formie: < 2.2.20 → fixed in 2.2.20

Description

Impact • Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). • Sites with public Formie forms that include at least one Hidden field with that configuration. • No CP login for the reported chain. Patches • 2.2.20, 3.1.24 Workarounds • Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible • Otherwise, upgrade to patched versions

Related

Alias · CVE (1)

  • CVE-2026-45697 Formie is a Craft CMS plugin for creating forms. vulnerability

Weakness · CWE (3)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness
  • CWE-693 Protection Mechanism Failure weakness
  • CWE-94 Improper Control of Generation of Code weakness

References