Executive brief
Formie, a form-building plugin for the Craft CMS, contains a vulnerability in how it handles hidden form fields. An attacker can send specially crafted web requests that trick the server into executing malicious code when a form is displayed to a user. This could allow an unauthorized person to steal sensitive data, modify website content, or take full control of the server.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in the front-end rendering path of Formie's Hidden fields. When a Hidden field is configured to use dynamic default values (such as User-Agent, Referer, or Query Parameters), the application fails to sanitize these request-derived values before passing them to the Twig rendering engine in `Hidden::getFrontEndInputOptions()`. An unauthenticated remote attacker can inject Twig syntax into these request headers or parameters, leading to arbitrary code execution or sensitive information disclosure within the Craft CMS environment. The vulnerability is patched in version 3.1.27 by treating request-derived values as plain strings rather than template sources.
Affected products
- Verbb Formie >= 3.0.0-beta.1, <= 3.1.26
Timeline
- 2026-05-30: disclosed
- 2026-05-30: advisory
- 2026-07-06: patched: Date of reviewed advisory publication confirming patch version 3.1.27