Is CVE-2026-45697 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45697 being exploited in the wild.

How severe is CVE-2026-45697?

Critical severity, with a CVSS score of 9.8, published 29 May 2026.

Which products and versions are affected?

verbb/formie (Packagist) ECOSYSTEM:introduced=3.0.0-beta.1,fixed=3.1.24; Verbb Formie = 3.0.0-beta.1, < 3.1.24.

Is there a fix for CVE-2026-45697?

Yes. verbb/formie (Packagist): upgrade to 3.1.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45697 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45697?

Check whether you run verbb/formie (Packagist) or Verbb Formie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45697: Verbb Formie server-side template injection in Hidden fields

Q: Is there a fix for CVE-2026-45697?

Yes. verbb/formie (Packagist): upgrade to 3.1.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45697 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45697?

Check whether you run verbb/formie (Packagist) or Verbb Formie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45697 · Severity: critical · CVSS 9.8 · Published 2026-05-29

Formie is a plugin for Craft CMS used to create and manage web forms. A vulnerability in how the plugin handles hidden form fields allows unauthenticated attackers to submit malicious code that the server then executes. This could lead to a complete takeover of the website, theft of sensitive data, or disruption of services.

Technologies: verbb/formie (Packagist), Verbb Formie. Vendors: Packagist, Verbb.

Quick answers

Is CVE-2026-45697 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45697 being exploited in the wild.
How severe is CVE-2026-45697?: Critical severity, with a CVSS score of 9.8, published 29 May 2026.
Which products and versions are affected?: verbb/formie (Packagist) ECOSYSTEM:introduced=3.0.0-beta.1,fixed=3.1.24; Verbb Formie < 2.2.20, < 3.1.24, < 2.2.20, >= 3.0.0-beta.1, < 3.1.24.
Is there a fix for CVE-2026-45697?: Yes. verbb/formie (Packagist): upgrade to 3.1.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45697 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45697?: Check whether you run verbb/formie (Packagist) or Verbb Formie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

verbb/formie (Packagist): upgrade to 3.1.24 or later
```
composer require verbb/formie:^3.1.24
```

Technical details

A server-side template injection (SSTI) vulnerability exists in the Formie plugin for Craft CMS due to improper handling of Hidden fields configured with a 'Custom' default value. During submission handling, the plugin evaluates user-supplied input as Twig templates. An unauthenticated remote attacker can exploit this by submitting crafted values into these hidden fields, leading to arbitrary code execution within the context of the Twig environment. The impact depends on the specific template sandbox configuration but can result in full server compromise. The issue is addressed in versions 2.2.20 and 3.1.24 by ensuring only the intended default values are parsed as templates rather than raw user input.

Affected products

Verbb Formie < 2.2.20, < 3.1.24

Identifiers

CVE-2026-45697
GHSA-x7m9-mwc2-g6w2

Timeline

2026-05-10: patched: Fixes released in versions 2.2.20 and 3.1.24
2026-05-12: advisory: GitHub Security Advisory published
2026-05-29: disclosed: CVE-2026-45697 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.