Is CVE-2026-73858 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73858 being exploited in the wild.

How severe is CVE-2026-73858?

Medium severity, with a CVSS score of 5.3, published 23 September 2026.

Which products and versions are affected?

solspace/craft-freeform (Packagist) >= 5.0.0, <= 5.10.13, ECOSYSTEM:introduced=5.0.0,fixed=5.10.14; Solspace Freeform 5.0.0 through 5.10.13.

Is there a fix for CVE-2026-73858?

Yes. solspace/craft-freeform (Packagist): upgrade to 5.10.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73858 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73858?

Check whether you run solspace/craft-freeform (Packagist) or Solspace Freeform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73858: Solspace Freeform Twig template injection via form field values

Q: Is there a fix for CVE-2026-73858?

Yes. solspace/craft-freeform (Packagist): upgrade to 5.10.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-73858 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-73858?

Check whether you run solspace/craft-freeform (Packagist) or Solspace Freeform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73858 · Severity: medium · CVSS 5.3 · Published 2026-09-23

Solspace Freeform is a popular form-building plugin for Craft CMS that allows website administrators to create and manage custom forms. An unauthenticated attacker can submit specially crafted form data containing Twig template expressions, which are evaluated server-side and reflected back in form responses. While the vulnerability is limited by Freeform's sandboxed Twig environment, it can be used to disclose sensitive server information such as PHP version, operating system details, and absolute filesystem paths—valuable reconnaissance data for further attacks.

Technologies: solspace/craft-freeform (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-73858 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73858 being exploited in the wild.
How severe is CVE-2026-73858?: Medium severity, with a CVSS score of 5.3, published 23 September 2026.
Which products and versions are affected?: solspace/craft-freeform (Packagist) >= 5.0.0, <= 5.10.13, ECOSYSTEM:introduced=5.0.0,fixed=5.10.14; Solspace Freeform 5.0.0 through 5.10.13.
Is there a fix for CVE-2026-73858?: Yes. solspace/craft-freeform (Packagist): upgrade to 5.10.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73858 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73858?: Check whether you run solspace/craft-freeform (Packagist) or Solspace Freeform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

solspace/craft-freeform (Packagist): upgrade to 5.10.14 or later
```
composer require solspace/craft-freeform:^5.10.14
```

Technical details

The vulnerability is a server-side Twig template injection (SSTI) in Solspace Freeform versions 5.0.0 through 5.10.13. The root cause is that user-submitted form field values are passed through Freeform's Twig renderer without proper sanitization or escaping, allowing attackers to inject Twig expressions. The attack vector is unauthenticated (no login required) and requires only access to a public Freeform form. Attackers can use the `constant()` Twig function to access PHP and Craft constants, disclosing PHP version, OS, and filesystem paths. The impact is limited: testing confirmed no access to sensitive globals, environment variables, database/mailer credentials, or remote code execution. The issue has been patched by preventing submitted field values from being evaluated as Twig templates.

Affected products

Solspace Freeform 5.0.0 through 5.10.13

Identifiers

CVE-2026-73858
GHSA-gxrg-x694-283w

Timeline

2026-09-23: disclosed: Advisory published
patched: Patched in version after 5.10.13

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.