Is CVE-2026-103542 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103542 being exploited in the wild.

How severe is CVE-2026-103542?

Medium severity, with a CVSS score of 4.3, published 1 October 2026.

Which products and versions are affected?

Formtools.Org Form Tools up to 3.1.1.

Is there a fix for CVE-2026-103542?

No fixed version is recorded yet. Restrict the smart_fill endpoint to administrators bound to in-progress sessions and enforce a whitelist of allowed HTTP/HTTPS schemes while blocking RFC1918 and reserved IP ranges, link-local addresses, and 169.254.0.0/16. [{"kind":"disclosed","at":"2026-09-03","note":"Issue reported on GitHub"},{"kind":"advisory","at":"2026-10-01","note":"CVE-2026-103542 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-103542 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103542?

Check whether you run Formtools.Org Form Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103542: Form Tools smart_fill endpoint server-side request forgery

CVE-2026-103542 · Severity: medium · CVSS 4.3 · Published 2026-10-01

Form Tools is a web-based form management system. The AJAX endpoint contains a vulnerability in the smart_fill function that allows any authenticated user to make the server fetch and return arbitrary URLs, including internal services and cloud credential endpoints. An attacker with any account (client or admin) can read sensitive data from internal systems, cloud metadata, and port fingerprint internal services.

Technologies: Formtools.Org Form Tools. Vendors: Formtools.Org.

Quick answers

Is CVE-2026-103542 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103542 being exploited in the wild.
How severe is CVE-2026-103542?: Medium severity, with a CVSS score of 4.3, published 1 October 2026.
Which products and versions are affected?: Formtools.Org Form Tools up to 3.1.1.
Is there a fix for CVE-2026-103542?: No fixed version is recorded yet. Restrict the smart_fill endpoint to administrators bound to in-progress sessions and enforce a whitelist of allowed HTTP/HTTPS schemes while blocking RFC1918 and reserved IP ranges, link-local addresses, and 169.254.0.0/16.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-03","note":"Issue reported on GitHub"},{"kind":"advisory","at":"2026-10-01","note":"CVE-2026-103542 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103542 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103542?: Check whether you run Formtools.Org Form Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict the smart_fill endpoint to administrators bound to in-progress sessions and enforce a whitelist of allowed HTTP/HTTPS schemes while blocking RFC1918 and reserved IP ranges, link-local addresses, and 169.254.0.0/16.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-03","note":"Issue reported on GitHub"},{"kind":"advisory","at":"2026-10-01","note":"CVE-2026-103542 published"}]

Technical details

The vulnerability is a server-side request forgery (SSRF) in the smart_fill branch of /global/code/actions.php. Authenticated users control the url and scrape_method parameters which are passed directly to file_get_contents() or curl_exec() without validation of scheme, hostname, or reserved IP ranges. The fetched response is echoed back to the attacker, enabling information disclosure from internal networks and cloud metadata services.

Affected products

formtools.org Form Tools up to 3.1.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.