CVE-2026-45697
CRITICALFormie: Pre-authenticated server-side template injection in Hidden fields
Title source: cnaDescription
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.
References (4)
Core 4
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2
X_Refsource_Misc x_refsource_misc
https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3
X_Refsource_Misc x_refsource_misc
https://github.com/verbb/formie/releases/tag/2.2.20
X_Refsource_Misc x_refsource_misc
https://github.com/verbb/formie/releases/tag/3.1.24
Scores
CVSS v3
9.8
EPSS
0.0047
EPSS Percentile
37.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-1336
CWE-693
CWE-94
Status
published
Products (4)
verbb/formie
0 - 2.2.20Packagist
verbb/formie
3.0.0-beta.1 - 3.1.24Packagist
verbb/formie
< 2.2.20
verbb/formie
>= 3.0.0-beta.1, < 3.1.24
Published
May 29, 2026
Tracked Since
May 30, 2026