Executive brief
Formie is a plugin for Craft CMS used to create and manage web forms. A vulnerability in how the plugin handles hidden form fields allows unauthenticated attackers to submit malicious code that the server then executes. This could lead to a complete takeover of the website, theft of sensitive data, or disruption of services.
Technical details
A server-side template injection (SSTI) vulnerability exists in the Formie plugin for Craft CMS due to improper handling of Hidden fields configured with a 'Custom' default value. During submission handling, the plugin evaluates user-supplied input as Twig templates. An unauthenticated remote attacker can exploit this by submitting crafted values into these hidden fields, leading to arbitrary code execution within the context of the Twig environment. The impact depends on the specific template sandbox configuration but can result in full server compromise. The issue is addressed in versions 2.2.20 and 3.1.24 by ensuring only the intended default values are parsed as templates rather than raw user input.
Affected products
- Verbb Formie < 2.2.20, < 3.1.24
Timeline
- 2026-05-10: patched: Fixes released in versions 2.2.20 and 3.1.24
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE-2026-45697 published to NVD