Formie CVE-2026-52889

Exploitation requires the target Craft CMS site to publicly render a Formie form (verbb/formie 3.0.0-beta.1-3.1.26) that contains a Hidden field configured with one of the request-derived dynamic default value types: HTTP User Agent, HTTP Referer URL, Current URL, Current URL without Query String, Query Parameter, or Cookie Value. The attacker then supplies Twig syntax in the corresponding request element (that header, cookie, URL, or query parameter) and triggers server-side evaluation simply by causing the form to render. Per the CVSS vector (PR:N/UI:N) the attacker is unauthenticated and no victim interaction is needed. The principal limiting factor is that this Hidden-field-with-request-derived-default configuration is not the default form setup - sites without such a field are not exploitable - and the ultimate impact (info disclosure vs. state change vs. RCE) further depends on which application objects and functions the site's Twig environment exposes.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes network-reachable, unauthenticated, low-complexity exploitation with full CIA impact - consistent with unauthenticated SSTI-to-RCE. The key real-world limiter is configuration-dependent: exploitation is only possible if a public form actually contains a Hidden field wired to a request-derived default, which is not Craft/Formie's default posture, so the true attack surface is narrower than the 9.8 alone implies. No EPSS score, KEV listing, SSVC decision, or POC was supplied, so probability-of-exploitation signals are absent; this should be treated as high-impact-if-configured rather than confirmed widespread exploitation. There is no conflict between the vector and the description - both point to remote unauthenticated triggering - but the automatability and in-the-wild status are genuinely unknown from the provided data.

An attacker identifies a public Craft CMS site running Formie with a contact or signup form whose Hidden field captures, for example, the Referer or a query parameter as its default. The attacker requests the form page with a crafted Twig payload placed in that request element (e.g., the Referer header or ?param= value); when Formie renders the form, Craft's Twig engine evaluates the payload server-side, letting the attacker read application secrets or, depending on exposed Twig capabilities and site configuration, execute code. No authentication or user interaction is required and complexity is low, though no public POC was provided.