# CVE-2026-45697: Verbb Formie server-side template injection in Hidden fields

Source: https://junglewise.ai/threats/cve-2026-45697-verbb-formie-server-side-template-injection-in-hidden-fields  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-45697 · Severity: critical · CVSS 9.8 · Published 2026-05-29

Formie is a plugin for Craft CMS used to create and manage web forms. A vulnerability in how the plugin handles hidden form fields allows unauthenticated attackers to submit malicious code that the server then executes. This could lead to a complete takeover of the website, theft of sensitive data, or disruption of services.

Technologies: [verbb/formie (Packagist)](https://junglewise.ai/threats/technologies/verbb-formie), [Verbb Formie](https://junglewise.ai/threats/technologies/formie). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Verbb](https://junglewise.ai/threats/vendors/verbb).

## Quick answers

**Is CVE-2026-45697 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45697 being exploited in the wild.

**How severe is CVE-2026-45697?** Critical severity, with a CVSS score of 9.8, published 29 May 2026.

**Which products and versions are affected?** verbb/formie (Packagist) ECOSYSTEM:introduced=3.0.0-beta.1,fixed=3.1.24; Verbb Formie < 2.2.20, < 3.1.24, < 2.2.20, >= 3.0.0-beta.1, < 3.1.24.

**Is there a fix for CVE-2026-45697?** Yes. verbb/formie (Packagist): upgrade to 3.1.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45697 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45697?** Check whether you run verbb/formie (Packagist) or Verbb Formie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- verbb/formie (Packagist): upgrade to 3.1.24 or later

  ```sh
  composer require verbb/formie:^3.1.24
  ```


## Technical details

A server-side template injection (SSTI) vulnerability exists in the Formie plugin for Craft CMS due to improper handling of Hidden fields configured with a 'Custom' default value. During submission handling, the plugin evaluates user-supplied input as Twig templates. An unauthenticated remote attacker can exploit this by submitting crafted values into these hidden fields, leading to arbitrary code execution within the context of the Twig environment. The impact depends on the specific template sandbox configuration but can result in full server compromise. The issue is addressed in versions 2.2.20 and 3.1.24 by ensuring only the intended default values are parsed as templates rather than raw user input.

## Affected products

- Verbb Formie < 2.2.20, < 3.1.24

## Identifiers

- CVE-2026-45697
- GHSA-x7m9-mwc2-g6w2

## Timeline

- 2026-05-10: patched: Fixes released in versions 2.2.20 and 3.1.24
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE-2026-45697 published to NVD

## References

- [https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3](https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3)
- [https://github.com/verbb/formie/releases/tag/2.2.20](https://github.com/verbb/formie/releases/tag/2.2.20)
- [https://github.com/verbb/formie/releases/tag/3.1.24](https://github.com/verbb/formie/releases/tag/3.1.24)
- [https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2](https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2)

## Related threats

- [Verbb Formie missing authorization on sent notification resend modal](https://junglewise.ai/threats/cve-2026-76089-verbb-formie-missing-authorization-on-sent-notification-resend)
- [Verbb Formie unauthenticated submission hijacking via submit action](https://junglewise.ai/threats/cve-2026-76087-verbb-formie-unauthenticated-submission-hijacking-via-submit)
- [Craft Formie integration form-settings SSRF and credential exfiltration](https://junglewise.ai/threats/cve-2026-76086-craft-formie-integration-form-settings-ssrf-and-credential)
- [Verbb Formie missing authorization in administrative settings](https://junglewise.ai/threats/verbb-formie-missing-authorization-in-administrative-settings-0ab8bf10)
- [Verbb Formie server-side template injection in Hidden fields](https://junglewise.ai/threats/cve-2026-52889-verbb-formie-server-side-template-injection-in-hidden-fields)