Executive brief
The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability
Affected products
- Packagist solspace/craft-freeform
Junglewise Threat Intelligence
CVE-2025-52122: The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability
CVE-2025-52122 · Severity: low · CVSS 3.1 · Published 2025-08-27
Technologies: solspace/craft-freeform (Packagist). Vendors: Packagist.
Related threats
- Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public
- Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue
- solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
- solspace/craft-freeform Has a DoS Vulnerability