Formwork CVE-2026-105950

Exploitation requires an authenticated account with privileges to submit HTML content that passes through Formwork's DomSanitizer (PR:L) - this is not an unauthenticated flaw. The specific trigger is an HTML element bearing a 'formaction' attribute, which in Formwork ≤2.3.12 was absent from the HtmlReference URI-attribute list and therefore not URI-sanitized, allowing a javascript:-style or script-bearing payload to survive. Exploitation is further LIMITED by required victim interaction (UI:P): a second user must view and activate the injected form control for the payload to execute. The flaw is fixed in 2.3.13, which adds 'formaction' (and related attributes like archive, cite, data, poster, usemap) to the sanitized set.

This is a medium-severity stored/DOM cross-site scripting flaw (CWE-79) whose real-world priority is modest. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N, score 5.1) tells a consistent story: remotely reachable and low-complexity, but gated by two meaningful barriers - PR:L means the attacker must already hold a low-privilege authenticated account (i.e. an account able to submit the sanitizer-processed content), and UI:P means a victim must interact with the malicious element before the payload fires. Impact is limited to integrity in the victim's browser context (VI:L) with no confidentiality or availability impact asserted by the vendor. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public proof-of-concept was supplied in the intelligence - so there is no public exploit identified at time of analysis. The only corroborating sources are VulDB (the reporter) and the vendor's own GHSA advisory plus the patch commit, which confirm the vulnerability and fix but indicate no observed exploitation. Note one conflict worth flagging to defenders: the vendor scored confidentiality as VC:N, yet formaction-based XSS executing in an authenticated admin/editor session can realistically read session-scoped data, so my independent assessment raises confidentiality to Low - verify impact scope against your deployment's role model. Net: a legitimate bug to patch on a normal cycle, not an emergency.

An attacker holding a low-privilege authoring account in a Formwork site injects a crafted 'formaction' attribute that the DomSanitizer fails to recognize as a URI-bearing attribute, smuggling a script payload past sanitization. When an administrator or another user later views the content and activates the associated form control (e.g. clicks the button), the formaction payload executes JavaScript in their browser session. No public exploit code was provided in the intelligence, so exploitation would require the attacker to craft the payload themselves.