CVE-2026-45697

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3
https://github.com/verbb/formie/releases/tag/2.2.20
https://github.com/verbb/formie/releases/tag/3.1.24
https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2

Configurations

No configuration.

History

22 Jul 2026, 06:10

Type	Values Removed	Values Added
Summary		(es) Formie es un plugin de Craft CMS para crear formularios. Antes de las versiones 2.2.20 y 3.1.24, los usuarios no autenticados podían enviar valores manipulados en campos ocultos (con Valor predeterminado ? Personalizado) que eran evaluados como Twig durante el procesamiento del envío, lo que podría llevar a un compromiso grave del sitio de Craft (dependiendo del comportamiento de la plantilla/sandbox). Esta vulnerabilidad está corregida en las versiones 2.2.20 y 3.1.24.

29 May 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-29 20:16

Updated : 2026-07-22 06:10

NVD link : CVE-2026-45697

Mitre link : CVE-2026-45697

CVE.ORG link : CVE-2026-45697

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-693

Protection Mechanism Failure

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2026-45697", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45697", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-01T15:18:36.758634Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "verbb", "product": "formie", "versions": [{"status": "affected", "version": "< 2.2.20"}, {"status": "affected", "version": ">= 3.0.0-beta.1, < 3.1.24"}]}]}], "published": "2026-05-29T20:16:27.393", "references": [{"url": "https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3", "source": "security-advisories@github.com"}, {"url": "https://github.com/verbb/formie/releases/tag/2.2.20", "source": "security-advisories@github.com"}, {"url": "https://github.com/verbb/formie/releases/tag/3.1.24", "source": "security-advisories@github.com"}, {"url": "https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-693"}, {"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value \u2192 Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24."}, {"lang": "es", "value": "Formie es un plugin de Craft CMS para crear formularios. Antes de las versiones 2.2.20 y 3.1.24, los usuarios no autenticados pod\u00edan enviar valores manipulados en campos ocultos (con Valor predeterminado ? Personalizado) que eran evaluados como Twig durante el procesamiento del env\u00edo, lo que podr\u00eda llevar a un compromiso grave del sitio de Craft (dependiendo del comportamiento de la plantilla/sandbox). Esta vulnerabilidad est\u00e1 corregida en las versiones 2.2.20 y 3.1.24."}], "lastModified": "2026-07-22T06:10:00.170", "sourceIdentifier": "security-advisories@github.com"}