# CVE-2026-73858: Solspace Freeform Twig template injection via form field values

Source: https://junglewise.ai/threats/cve-2026-73858-solspace-freeform-twig-template-injection-via-form-field-values  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73858 · Severity: medium · CVSS 5.3 · Published 2026-09-23

Solspace Freeform is a popular form-building plugin for Craft CMS that allows website administrators to create and manage custom forms. An unauthenticated attacker can submit specially crafted form data containing Twig template expressions, which are evaluated server-side and reflected back in form responses. While the vulnerability is limited by Freeform's sandboxed Twig environment, it can be used to disclose sensitive server information such as PHP version, operating system details, and absolute filesystem paths—valuable reconnaissance data for further attacks.

Technologies: [solspace/craft-freeform (Packagist)](https://junglewise.ai/threats/technologies/solspace-craft-freeform). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-73858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73858 being exploited in the wild.

**How severe is CVE-2026-73858?** Medium severity, with a CVSS score of 5.3, published 23 September 2026.

**Which products and versions are affected?** solspace/craft-freeform (Packagist) >= 5.0.0, <= 5.10.13, ECOSYSTEM:introduced=5.0.0,fixed=5.10.14; Solspace Freeform 5.0.0 through 5.10.13.

**Is there a fix for CVE-2026-73858?** Yes. solspace/craft-freeform (Packagist): upgrade to 5.10.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73858 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-73858?** Check whether you run solspace/craft-freeform (Packagist) or Solspace Freeform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- solspace/craft-freeform (Packagist): upgrade to 5.10.14 or later

  ```sh
  composer require solspace/craft-freeform:^5.10.14
  ```


## Technical details

The vulnerability is a server-side Twig template injection (SSTI) in Solspace Freeform versions 5.0.0 through 5.10.13. The root cause is that user-submitted form field values are passed through Freeform's Twig renderer without proper sanitization or escaping, allowing attackers to inject Twig expressions. The attack vector is unauthenticated (no login required) and requires only access to a public Freeform form. Attackers can use the `constant()` Twig function to access PHP and Craft constants, disclosing PHP version, OS, and filesystem paths. The impact is limited: testing confirmed no access to sensitive globals, environment variables, database/mailer credentials, or remote code execution. The issue has been patched by preventing submitted field values from being evaluated as Twig templates.

## Affected products

- Solspace Freeform 5.0.0 through 5.10.13

## Identifiers

- CVE-2026-73858
- GHSA-gxrg-x694-283w

## Timeline

- 2026-09-23: disclosed: Advisory published
- patched: Patched in version after 5.10.13

## Related threats

- [Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue](https://junglewise.ai/threats/cve-2026-26188-freeform-craft-plugin-cp-ui-builder-integrations-has-stored-cross)
- [solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets](https://junglewise.ai/threats/solspace-craft-freeform-exposed-to-known-axios-vulnerabilities-via-4729a168)
- [solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data](https://junglewise.ai/threats/solspace-craft-freeform-vulnerable-to-xss-in-phpspreadsheet-html-writer-91c20d91)
- [solspace/craft-freeform Has a DoS Vulnerability](https://junglewise.ai/threats/solspace-craft-freeform-has-a-dos-vulnerability-b273aed2)
- [The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability](https://junglewise.ai/threats/cve-2025-52122-the-freeform-craftcms-plugin-contains-an-server-side-template)