Craft Freeform
Monthly
Server-side Twig template injection in Solspace Freeform 5.0.0 through 5.10.13 for Craft CMS 5.x lets unauthenticated attackers submit Twig expressions through public forms that are evaluated by Freeform's isolated Twig renderer when field values are rendered back into HTML attributes (the vendor fix excludes the value, name, and id attributes from rendering). Confirmed impact is limited to disclosure of PHP/core and Craft bootstrap constants such as PHP_VERSION, PHP_OS, CRAFT_BASE_PATH, and CRAFT_VENDOR_PATH, plus possible form rendering errors from malformed Twig; no access to Craft globals, getenv(), alias(), database or mailer credentials, security/license keys, arbitrary files, or code execution was demonstrated in testing. Publicly available exploit code exists in the form of one-line payloads published in the vendor's GitHub security advisory (e.g. {{ constant('PHP_VERSION') }}@example.com), but there is no evidence of confirmed active exploitation (not listed in CISA KEV); CVSS 5.3 and the advisory's isolated-sandbox findings indicate low severity.
Server-side Twig template injection in Solspace Freeform 5.0.0 through 5.10.13 for Craft CMS 5.x lets unauthenticated attackers submit Twig expressions through public forms that are evaluated by Freeform's isolated Twig renderer when field values are rendered back into HTML attributes (the vendor fix excludes the value, name, and id attributes from rendering). Confirmed impact is limited to disclosure of PHP/core and Craft bootstrap constants such as PHP_VERSION, PHP_OS, CRAFT_BASE_PATH, and CRAFT_VENDOR_PATH, plus possible form rendering errors from malformed Twig; no access to Craft globals, getenv(), alias(), database or mailer credentials, security/license keys, arbitrary files, or code execution was demonstrated in testing. Publicly available exploit code exists in the form of one-line payloads published in the vendor's GitHub security advisory (e.g. {{ constant('PHP_VERSION') }}@example.com), but there is no evidence of confirmed active exploitation (not listed in CISA KEV); CVSS 5.3 and the advisory's isolated-sandbox findings indicate low severity.