Executive brief
Solspace Freeform is a popular form-building plugin for Craft CMS that allows website administrators to create and manage custom forms. An unauthenticated attacker can submit specially crafted form data containing Twig template expressions, which are evaluated server-side and reflected back in form responses. While the vulnerability is limited by Freeform's sandboxed Twig environment, it can be used to disclose sensitive server information such as PHP version, operating system details, and absolute filesystem paths—valuable reconnaissance data for further attacks.
Technical details
The vulnerability is a server-side Twig template injection (SSTI) in Solspace Freeform versions 5.0.0 through 5.10.13. The root cause is that user-submitted form field values are passed through Freeform's Twig renderer without proper sanitization or escaping, allowing attackers to inject Twig expressions. The attack vector is unauthenticated (no login required) and requires only access to a public Freeform form. Attackers can use the `constant()` Twig function to access PHP and Craft constants, disclosing PHP version, OS, and filesystem paths. The impact is limited: testing confirmed no access to sensitive globals, environment variables, database/mailer credentials, or remote code execution. The issue has been patched by preventing submitted field values from being evaluated as Twig templates.
Affected products
- Solspace Freeform 5.0.0 through 5.10.13
Timeline
- 2026-09-23: disclosed: Advisory published
- patched: Patched in version after 5.10.13