Form Tools CVE-2026-103540

Exploitation requires an authenticated account with sufficient privilege to access the Client Settings component of Form Tools (PR:L) and reach the updateClientSettingsTab code path; the attacker then supplies template-engine metacharacters in the page_titles argument. Affected: Form Tools up to and including version 3.1.1. Limiting factors: the attacker must already have valid (low-privilege) credentials/session, and the vendor-assigned impact is capped at Low across confidentiality, integrity, and availability, implying the template evaluation context may be restricted rather than permitting unrestricted code execution. No special non-default configuration is named, but a template engine processing the affected setting must be in use. No patched version is available, as the project has not responded.

Real-world risk is modest-to-low despite the SSTI (CWE-1336) classification. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates remote, low-complexity exploitation but requires low-level authentication (PR:L - i.e. an existing client/user able to reach the Client Settings tab) and yields only limited confidentiality, integrity, and availability impact, scoring 5.3 (Medium). Notably, the vector carries E:P (Proof-of-Concept exploit maturity), consistent with the publicly disclosed exploit write-up. There is no EPSS score and no CISA KEV listing in the provided data, so there is no evidence of active or widespread exploitation - exploitation status is 'publicly available exploit code exists' only. A tension worth flagging: CWE-1336 (template-engine injection) frequently enables full RCE and thus would often warrant High/Critical impact, yet VulDB (the sole reporting source) rates every impact metric only Low, suggesting the injection is constrained (limited sink or sandboxed template context) rather than a full unrestricted SSTI-to-RCE - this impact ceiling should be independently verified against the public PoC, since if it is a genuine unrestricted SSTI the real severity could be materially higher than 5.3. The vendor has not responded to the issue report, so no patch is confirmed available.

An authenticated low-privilege Form Tools user navigates to the Client Settings tab and submits a crafted value in the page_titles argument containing template-engine syntax, which is passed unsanitized into Clients::updateClientSettingsTab and evaluated by the template engine. A public PoC/exploit write-up exists (hosted on GitHub by researcher 'wawyw'), lowering the effort to reproduce. Depending on how constrained the template context is, the attacker can disclose or manipulate limited server-side data, with the vendor-rated impact capped at Low across CIA.