Solspace Freeform CVE-2026-73858

No authentication or user interaction required - the attacker only needs a reachable public Freeform form on a Craft CMS 5.x site running Freeform 5.0.0 through 5.10.13. Exploitation depends on submitted field values being rendered back into HTML attributes where the isolated Twig renderer evaluates them (the fix excludes the value, name, and id attributes from Twig rendering). Impact is LIMITED by the isolated Twig sandbox: only PHP/core constants (PHP_VERSION, PHP_OS) and Craft bootstrap path constants (CRAFT_BASE_PATH, CRAFT_VENDOR_PATH) are reachable - Craft globals, getenv(), alias(), database/mailer credentials, security/license keys, arbitrary file access, and code execution were not exposed in testing.

This is a genuine but low-severity issue that CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) captures accurately: unauthenticated, network-reachable, low-complexity, but confined to limited confidentiality impact with no integrity or availability effect. The CWE-1336 (server-side template injection) classification would normally raise RCE concerns, but both the vendor advisory (GHSA-gxrg-x694-283w) and testing explicitly confirm the isolated Twig context did NOT expose Craft globals, environment variables, database/mailer credentials, security/license keys, arbitrary files, or code execution - only PHP/core constants and Craft bootstrap path constants. So this is a case where the SSTI class label overstates real risk: confirmed impact is server/environment information disclosure (PHP version, OS, absolute filesystem paths). No EPSS score is provided and it is not in CISA KEV, so no signal of widespread or active exploitation exists - treat as 'no public exploit weaponized' despite the advisory containing a working proof-of-concept. A publicly documented PoC lowers the barrier to opportunistic scanning, but the low-value payoff (path/version disclosure, useful mainly for reconnaissance) makes this a moderate-priority patch rather than an emergency. The 'RCE' tag in the input is contradicted by the vendor's own testing and should not drive prioritization.

An unauthenticated attacker locates a public Freeform form on a Craft CMS site and submits a field value containing a Twig expression such as {{ constant('CRAFT_VENDOR_PATH') }} or {{ constant('PHP_VERSION') }}@example.com. When the submitted value is reflected back into an HTML attribute (e.g. value="..."), the isolated Twig renderer evaluates it and the response leaks the server's PHP version, OS, or absolute filesystem paths. A working proof-of-concept is published in the GHSA advisory, but the disclosed data is limited to reconnaissance-grade server/environment information rather than credentials or code execution.