Formie CVE-2026-45697
CRITICAL
GHSA-x7m9-mwc2-g6w2
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Impact
- Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior).
- Sites with public Formie forms that include at least one Hidden field with that configuration.
- No CP login for the reported chain.
Patches
Workarounds
- Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible
- Otherwise, upgrade to patched versions
AnalysisAI
Pre-authenticated server-side template injection in Verbb Formie (a forms plugin for Craft CMS) allows unauthenticated remote attackers to submit crafted values into Hidden fields configured with a Custom default value, which are then evaluated as Twig during submission handling. Successful exploitation can lead to arbitrary code execution and full compromise of the Craft site depending on template sandbox behavior. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Craft CMS installations running Verbb Formie and document their current versions. Within 7 days: Apply the vendor-released patch from Verbb's security advisory to all affected instances and verify successful deployment. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today