Form Tools EUVD-2026-90502

Exploitation requires an authenticated low-privileged account (PR:L) on a Form Tools ≤3.1.1 instance and the ability to reach the AJAX endpoint backed by the smart_fill function in /global/code/actions.php; the attacker supplies a malicious value in the 'url' argument. No user interaction is needed. Limiting factors: prior authentication is required (not an unauthenticated flaw), impact is confined to server-side request forgery (low confidentiality) with no direct code execution, and realistic severity depends on what internal services or cloud metadata endpoints are reachable from the server. No fix is available, so exposure persists until the vendor responds.

Real-world risk is modest. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N) scores 5.3 and indicates a network-reachable but authenticated (PR:L) flaw with only low confidentiality impact and no integrity or availability impact - consistent with a classic SSRF that lets an attacker coax the server into issuing outbound requests. The E:P (Proof-of-Concept) exploit maturity in the vector aligns with the stated 'exploit has been published,' so publicly available exploit code exists; however there is no KEV listing and no EPSS value supplied, so there is no evidence of active exploitation - these are distinct signals and should not be conflated. The requirement for prior authentication (PR:L) and the limited single-metric impact make this a lower-tier priority rather than an urgent one, though SSRF can be a stepping stone (internal service enumeration, cloud metadata access) depending on the deployment. Two cautions: the vendor-set scope is unchanged (SC:N), yet SSRF frequently warrants a scope change because the affected request targets a different system - this is arguable. Also notable: the project was notified via a GitHub issue but has not responded, so no fix is confirmed available, increasing exposure duration for deployed instances.

An authenticated low-privileged Form Tools user sends a crafted request to the AJAX endpoint in /global/code/actions.php, supplying an attacker-controlled value in the 'url' argument to the smart_fill function. The server dereferences that URL, letting the attacker reach internal-only services, cloud metadata endpoints, or map the internal network from the server's vantage point. A public proof-of-concept exploit has been published (github.com/wawyw/cve_report), lowering the barrier to exploitation.