# CVE-2026-103540: Form Tools Smarty template injection in client settings

Source: https://junglewise.ai/threats/cve-2026-103540-a-security-vulnerability-has-been-detected-in-formtools-org-form  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103540 · Severity: medium · CVSS 6.3 · Published 2026-10-01

Form Tools is a web-based form and survey management system. A low-privileged client can inject template code into page titles, which is then executed by an unsecured template engine, allowing arbitrary file read (including database credentials) and potentially server-side code execution.

Technologies: [Formtools.Org Form Tools](https://junglewise.ai/threats/technologies/form-tools). Vendors: [Formtools.Org](https://junglewise.ai/threats/vendors/formtools-org).

## Quick answers

**Is CVE-2026-103540 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103540 being exploited in the wild.

**How severe is CVE-2026-103540?** Medium severity, with a CVSS score of 6.3, published 1 October 2026.

**Which products and versions are affected?** Formtools.Org Form Tools up to 3.1.1.

**Is there a fix for CVE-2026-103540?** No fixed version is recorded yet. Restrict client access to account settings, or implement permission checks on the may_edit_page_titles flag in the updateClientSettingsTab method before persisting user input. Enable Smarty security mode and disable the {fetch} and {include_php} template functions in evalSmartyString.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103540 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103540?** Check whether you run Formtools.Org Form Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict client access to account settings, or implement permission checks on the may_edit_page_titles flag in the updateClientSettingsTab method before persisting user input. Enable Smarty security mode and disable the {fetch} and {include_php} template functions in evalSmartyString.</anigation>
</invoke>

## Technical details

The Clients::updateClientSettingsTab method fails to enforce the may_edit_page_titles permission when processing POST data, allowing authenticated clients to persist arbitrary template content in the page_titles field. This persisted content is immediately rendered using General::evalSmartyString with an unsecured Smarty 3.1.31 instance, enabling server-side template injection. Attackers can use {fetch} to read arbitrary files or {include_php} to execute PHP code.

## Affected products

- formtools.org Form Tools up to 3.1.1

## Timeline

- 2026-09-03: disclosed: Vulnerability reported as issue #956 on GitHub
- 2026-10-01: advisory: CVE-2026-103540 published

## References

- [https://github.com/formtools/core/issues/956](https://github.com/formtools/core/issues/956)
- [https://github.com/wawyw/cve_report/blob/main/formtools_1.md](https://github.com/wawyw/cve_report/blob/main/formtools_1.md)

## Related threats

- [Form Tools smart_fill endpoint server-side request forgery](https://junglewise.ai/threats/cve-2026-103542-a-flaw-has-been-found-in-formtools-org-form-tools-up-to-3-1-1)
- [Form Tools arbitrary PHP upload in smart_fill handler](https://junglewise.ai/threats/cve-2026-103541-a-vulnerability-was-detected-in-formtools-org-form-tools-up-to-3)