Skip to content
Threat Feed
Subscribe

Tag

Formie

2 briefs RSS
critical advisory

Formie Hidden Field SSTI Vulnerability (CVE-2026-52889)

Formie Hidden fields in versions prior to 3.1.27 are vulnerable to Server-Side Template Injection (SSTI), allowing an unauthenticated attacker to inject Twig syntax into request-derived default values, potentially leading to remote code execution, sensitive information disclosure, or application state modification.

Formie server-side-template-injection web-vulnerability craft-cms rce cve-2026-52889 network
1r 2t
critical advisory

Formie Plugin Server-Side Template Injection via Hidden Fields (CVE-2026-45697)

A pre-authenticated server-side template injection vulnerability (CVE-2026-45697) exists in the Hidden fields of the Formie Craft plugin, allowing unauthenticated users to submit crafted values that are evaluated as Twig during submission handling, potentially leading to site compromise.

Formie server-side template injection code-execution craftcms
2r 1t