Is CVE-2026-103540 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103540 being exploited in the wild.

How severe is CVE-2026-103540?

Medium severity, with a CVSS score of 6.3, published 1 October 2026.

Which products and versions are affected?

Formtools.Org Form Tools up to 3.1.1.

How is CVE-2026-103540 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-103540?

Check whether you run Formtools.Org Form Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103540: Form Tools Smarty template injection in client settings

CVE-2026-103540 · Severity: medium · CVSS 6.3 · Published 2026-10-01

Form Tools is a web-based form and survey management system. A low-privileged client can inject template code into page titles, which is then executed by an unsecured template engine, allowing arbitrary file read (including database credentials) and potentially server-side code execution.

Technologies: Formtools.Org Form Tools. Vendors: Formtools.Org.

Quick answers

Is CVE-2026-103540 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103540 being exploited in the wild.
How severe is CVE-2026-103540?: Medium severity, with a CVSS score of 6.3, published 1 October 2026.
Which products and versions are affected?: Formtools.Org Form Tools up to 3.1.1.
Is there a fix for CVE-2026-103540?: No fixed version is recorded yet. Restrict client access to account settings, or implement permission checks on the may_edit_page_titles flag in the updateClientSettingsTab method before persisting user input. Enable Smarty security mode and disable the {fetch} and {include_php} template functions in evalSmartyString.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103540 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-103540?: Check whether you run Formtools.Org Form Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict client access to account settings, or implement permission checks on the may_edit_page_titles flag in the updateClientSettingsTab method before persisting user input. Enable Smarty security mode and disable the {fetch} and {include_php} template functions in evalSmartyString.</anigation> </invoke>

Technical details

The Clients::updateClientSettingsTab method fails to enforce the may_edit_page_titles permission when processing POST data, allowing authenticated clients to persist arbitrary template content in the page_titles field. This persisted content is immediately rendered using General::evalSmartyString with an unsecured Smarty 3.1.31 instance, enabling server-side template injection. Attackers can use {fetch} to read arbitrary files or {include_php} to execute PHP code.

Affected products

formtools.org Form Tools up to 3.1.1

Timeline

2026-09-03: disclosed: Vulnerability reported as issue #956 on GitHub
2026-10-01: advisory: CVE-2026-103540 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.