EUVD-2026-62518
GHSA-565m-g33j-jq96
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable SSTI triggered by simply rendering the form (AV:N/PR:N/UI:N); AC:L since exploitation is reliable once the request-derived Hidden field exists, with full CIA impact from Twig-based RCE.
Primary rating from Vendor (https://github.com/verbb/formie).
CVSS VectorVendor: https://github.com/verbb/formie
Lifecycle Timeline
1DescriptionCVE.org
Summary
Formie Hidden fields could evaluate request-derived values as Twig during front-end form rendering.
When a Hidden field used a dynamic default value such as HTTP User Agent, Referer URL, Current URL, Query Parameter, or Cookie Value, the value was copied from the incoming request and later passed to Craft’s Twig rendering layer. This allowed an unauthenticated attacker to provide Twig syntax in request-controlled input and have it evaluated server-side when the form was rendered.
Affected Versions
verbb/formie for Craft 5:
- Affected: >= 3.0.0-beta.1, <= 3.1.26
- Patched: 3.1.27
Impact
An unauthenticated attacker could trigger server-side template evaluation by visiting a public form containing a Hidden field configured with a request-derived default value.
Because Craft’s normal Twig environment exposes application objects, this may lead to disclosure of sensitive information, modification of application state, or remote code execution depending on the site configuration and available Twig capabilities.
Technical Details
The issue exists in the Hidden field front-end render path. Request-derived Hidden field defaults were assigned to the field’s defaultValue, then rendered via Twig in Hidden::getFrontEndInputOptions().
The fix ensures Twig rendering is only performed for the custom default option, where the template source is admin-authored. Request-derived default options are now treated as plain strings.
Patches
Update to Formie 3.1.27 or later.
Workarounds
Until patched, avoid using request-derived Hidden field defaults on public forms, including:
- HTTP User Agent
- HTTP Refer URL
- Current URL
- Current URL without Query String
- Query Parameter
- Cookie Value
Alternatively, remove affected Hidden fields from public forms until the update is applied.
Credit
Name: Yanchon918s Email: [ao9s@ao9s.net](mailto:ao9s@ao9s.net)
AnalysisAI
Server-side template injection in Formie, a forms plugin for Craft CMS 5 (verbb/formie 3.0.0-beta.1 through 3.1.26), allows unauthenticated attackers to inject Twig syntax through request-controlled inputs that Hidden fields use as dynamic default values. When a public form contains a Hidden field seeded from the User Agent, Referer, Current URL, a query parameter, or a cookie, the attacker-supplied value reaches Craft's Twig rendering layer and is evaluated server-side, potentially yielding information disclosure, application-state modification, or remote code execution. No public exploit identified at time of analysis, though the flaw is tagged RCE/SSTI and rated CVSS 9.8.
Technical ContextAI
The vulnerability lives in Formie's Hidden field front-end render path. Formie is a form-builder plugin for Craft CMS, which is built on the Twig template engine (via Yii). Hidden fields support 'dynamic' default values that Formie copies from the incoming HTTP request (User Agent, Referer, Current URL, Current URL without query string, a named query parameter, or a cookie value). That request-derived value was assigned to the field's defaultValue and then passed through Twig in Hidden::getFrontEndInputOptions(), meaning untrusted request data was treated as a template rather than as data. This is a textbook CWE-1336 (Server-Side Template Injection in a template engine): because Craft's normal Twig environment exposes application objects and functions, evaluating attacker Twig can escalate from expression evaluation to sensitive-data access or code execution. The fix restricts Twig rendering to the admin-authored 'custom' default option and treats all request-derived defaults as plain strings. The affected package is pkg:composer/verbb_formie.
RemediationAI
Vendor-released patch: update verbb/formie to 3.1.27 or later (composer require verbb/formie:^3.1.27 then run migrations), per the advisory at https://github.com/verbb/formie/security/advisories/GHSA-565m-g33j-jq96. If immediate patching is not possible, the vendor-documented workaround is to stop using request-derived Hidden field defaults on public forms - specifically the HTTP User Agent, HTTP Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value options - reconfiguring those fields to static or custom admin-authored defaults instead; the trade-off is loss of any legitimate request-context capture those fields provided. Alternatively, remove the affected Hidden fields from public forms entirely until the update is applied, accepting that any downstream logic or analytics depending on those hidden values will break until the fields are restored on the patched version.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthentica
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injectio
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
Share
External POC / Exploit Code
Leaving vuln.today