Formie Hidden field defaults vulnerable to Server-Side Template Injection
The advisory, in context
Summary
Formie Hidden fields could evaluate request-derived values as Twig during front-end form rendering.
When a Hidden field used a dynamic default value such as HTTP User Agent, Referer URL, Current URL, Query Parameter, or Cookie Value, the value was copied from the incoming request and later passed to Craft’s Twig rendering layer. This allowed an unauthenticated attacker to provide Twig syntax in request-controlled input and have it evaluated server-side when the form was rendered.
Affected Versions
verbb/formie for Craft 5:
- Affected: >= 3.0.0-beta.1, <= 3.1.26
- Patched: 3.1.27
Impact
An unauthenticated attacker could trigger server-side template evaluation by visiting a public form containing a Hidden field configured with a request-derived default value.
Because Craft’s normal Twig environment exposes application objects, this may lead to disclosure of sensitive information, modification of application state, or remote code execution depending on the site configuration and available Twig capabilities.
Technical Details
The issue exists in the Hidden field front-end render path. Request-derived Hidden field defaults were assigned to the field’s defaultValue, then rendered via Twig in Hidden::getFrontEndInputOptions().
The fix ensures Twig rendering is only performed for the custom default option, where the template source is admin-authored. Request-derived default options are now treated as plain strings.
Patches
Update to Formie 3.1.27 or later.
Workarounds
Until patched, avoid using request-derived Hidden field defaults on public forms, including:
- HTTP User Agent
- HTTP Refer URL
- Current URL
- Current URL without Query String
- Query Parameter
- Cookie Value
Alternatively, remove affected Hidden fields from public forms until the update is applied.
Credit
Name: Yanchon918s Email: ao9s@ao9s.net
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 3.1.27
Fixed in 3.1.27
416 explicitly affected versions
1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.9.1, 1.1.0, 1.1.1, 1.1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.4.1, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.2.0, 1.2.1, 1.2.10, 1.2.11, 1.2.12, 1.2.13, 1.2.14, 1.2.15, 1.2.16, 1.2.17, 1.2.18, 1.2.19, 1.2.2, 1.2.20, 1.2.21, 1.2.22, 1.2.23, 1.2.23.1, 1.2.24, 1.2.25, 1.2.26, 1.2.27, 1.2.28, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.7.1, 1.2.8, 1.2.9, 1.3.0, 1.3.1, 1.3.10, 1.3.11, 1.3.12, 1.3.13, 1.3.14, 1.3.15, 1.3.16, 1.3.16.1, 1.3.17, 1.3.18, 1.3.19, 1.3.19.1, 1.3.2, 1.3.20, 1.3.21, 1.3.22, 1.3.23, 1.3.24, 1.3.25, 1.3.26, 1.3.27, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 1.4.0, 1.4.0.1, 1.4.1, 1.4.10, 1.4.11, 1.4.12, 1.4.13, 1.4.14, 1.4.15, 1.4.16, 1.4.17, 1.4.18, 1.4.19, 1.4.2, 1.4.20, 1.4.21, 1.4.21.1, 1.4.22, 1.4.23, 1.4.24, 1.4.25, 1.4.26, 1.4.27, 1.4.28, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9, 1.5.0, 1.5.1, 1.5.10, 1.5.11, 1.5.12, 1.5.13, 1.5.13.1, 1.5.13.2, 1.5.14, 1.5.15, 1.5.16, 1.5.17, 1.5.18, 1.5.19, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.5.9, 1.6.0, 1.6.1, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, 1.6.16, 1.6.17, 1.6.18, 1.6.19, 1.6.2, 1.6.20, 1.6.21, 1.6.22, 1.6.23, 1.6.24, 1.6.25, 1.6.26, 1.6.27, 1.6.28, 1.6.29, 1.6.3, 1.6.30, 1.6.31, 1.6.32, 1.6.33, 1.6.34, 1.6.35, 1.6.36, 1.6.36.1, 1.6.37, 1.6.38, 1.6.39, 1.6.4, 1.6.40, 1.6.41, 1.6.42, 1.6.43, 1.6.44, 1.6.45, 1.6.46, 1.6.47, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 2.0.0, 2.0.0-beta.1, 2.0.0-beta.10, 2.0.0-beta.11, 2.0.0-beta.12, 2.0.0-beta.13, 2.0.0-beta.14, 2.0.0-beta.15, 2.0.0-beta.16, 2.0.0-beta.2, 2.0.0-beta.3, 2.0.0-beta.4, 2.0.0-beta.5, 2.0.0-beta.6, 2.0.0-beta.7, 2.0.0-beta.8, 2.0.0-beta.9, 2.0.1, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.0.19, 2.0.2, 2.0.20, 2.0.21, 2.0.22, 2.0.23, 2.0.23.1, 2.0.24, 2.0.25, 2.0.25.1, 2.0.26, 2.0.27, 2.0.27.1, 2.0.28, 2.0.29, 2.0.3, 2.0.30, 2.0.31, 2.0.32, 2.0.33, 2.0.34, 2.0.34.1, 2.0.35, 2.0.36, 2.0.37, 2.0.38, 2.0.39, 2.0.4, 2.0.40, 2.0.41, 2.0.42, 2.0.43, 2.0.44, 2.0.44.1, 2.0.45, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.1.0, 2.1.1, 2.1.10, 2.1.11, 2.1.12, 2.1.13, 2.1.14, 2.1.15, 2.1.16, 2.1.17, 2.1.18, 2.1.19, 2.1.2, 2.1.20, 2.1.21, 2.1.22, 2.1.23, 2.1.24, 2.1.25, 2.1.26, 2.1.27, 2.1.28, 2.1.29, 2.1.3, 2.1.30, 2.1.31, 2.1.32, 2.1.33, 2.1.34, 2.1.35, 2.1.36, 2.1.37, 2.1.38, 2.1.39, 2.1.4, 2.1.40, 2.1.41, 2.1.42, 2.1.43, 2.1.44, 2.1.45, 2.1.46, 2.1.47, 2.1.48, 2.1.49, 2.1.5, 2.1.50, 2.1.51, 2.1.52, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.2.0, 2.2.1, 2.2.10, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15, 2.2.16, 2.2.17, 2.2.18, 2.2.19, 2.2.2, 2.2.20, 2.2.21, 2.2.22, 2.2.23, 2.2.24, 2.2.25, 2.2.26, 2.2.27, 2.2.28, 2.2.29, 2.2.3, 2.2.30, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 3.0.0, 3.0.0-beta.1, 3.0.0-beta.10, 3.0.0-beta.11, 3.0.0-beta.12, 3.0.0-beta.13, 3.0.0-beta.14, 3.0.0-beta.15, 3.0.0-beta.16, 3.0.0-beta.17, 3.0.0-beta.18, 3.0.0-beta.19, 3.0.0-beta.2, 3.0.0-beta.20, 3.0.0-beta.3, 3.0.0-beta.4, 3.0.0-beta.5, 3.0.0-beta.6, 3.0.0-beta.7, 3.0.0-beta.8, 3.0.0-beta.9, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.2, 3.0.20, 3.0.21, 3.0.22, 3.0.23, 3.0.24, 3.0.25, 3.0.26, 3.0.27, 3.0.28, 3.0.29, 3.0.3, 3.0.30, 3.0.31, 3.0.32, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.2, 3.1.20, 3.1.21, 3.1.22, 3.1.23, 3.1.24, 3.1.25, 3.1.26, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.27"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.0",
"1.0.1",
"1.0.2",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.6",
"1.0.7",
"1.0.8",
"1.0.9",
"1.0.9.1",
"1.1.0",
"1.1.1",
"1.1.1.1",
"1.1.2",
"1.1.3",
"1.1.4",
"1.1.4.1",
"1.1.5",
"1.1.6",
"1.1.7",
"1.1.8",
"1.2.0",
"1.2.1",
"1.2.10",
"1.2.11",
"1.2.12",
"1.2.13",
"1.2.14",
"1.2.15",
"1.2.16",
"1.2.17",
"1.2.18",
"1.2.19",
"1.2.2",
"1.2.20",
"1.2.21",
"1.2.22",
"1.2.23",
"1.2.23.1",
"1.2.24",
"1.2.25",
"1.2.26",
"1.2.27",
"1.2.28",
"1.2.3",
"1.2.4",
"1.2.5",
"1.2.6",
"1.2.7",
"1.2.7.1",
"1.2.8",
"1.2.9",
"1.3.0",
"1.3.1",
"1.3.10",
"1.3.11",
"1.3.12",
"1.3.13",
"1.3.14",
"1.3.15",
"1.3.16",
"1.3.16.1",
"1.3.17",
"1.3.18",
"1.3.19",
"1.3.19.1",
"1.3.2",
"1.3.20",
"1.3.21",
"1.3.22",
"1.3.23",
"1.3.24",
"1.3.25",
"1.3.26",
"1.3.27",
"1.3.3",
"1.3.4",
"1.3.5",
"1.3.6",
"1.3.7",
"1.3.8",
"1.3.9",
"1.4.0",
"1.4.0.1",
"1.4.1",
"1.4.10",
"1.4.11",
"1.4.12",
"1.4.13",
"1.4.14",
"1.4.15",
"1.4.16",
"1.4.17",
"1.4.18",
"1.4.19",
"1.4.2",
"1.4.20",
"1.4.21",
"1.4.21.1",
"1.4.22",
"1.4.23",
"1.4.24",
"1.4.25",
"1.4.26",
"1.4.27",
"1.4.28",
"1.4.3",
"1.4.4",
"1.4.5",
"1.4.6",
"1.4.7",
"1.4.8",
"1.4.9",
"1.5.0",
"1.5.1",
"1.5.10",
"1.5.11",
"1.5.12",
"1.5.13",
"1.5.13.1",
"1.5.13.2",
"1.5.14",
"1.5.15",
"1.5.16",
"1.5.17",
"1.5.18",
"1.5.19",
"1.5.2",
"1.5.3",
"1.5.4",
"1.5.5",
"1.5.6",
"1.5.7",
"1.5.8",
"1.5.9",
"1.6.0",
"1.6.1",
"1.6.10",
"1.6.11",
"1.6.12",
"1.6.13",
"1.6.14",
"1.6.15",
"1.6.16",
"1.6.17",
"1.6.18",
"1.6.19",
"1.6.2",
"1.6.20",
"1.6.21",
"1.6.22",
"1.6.23",
"1.6.24",
"1.6.25",
"1.6.26",
"1.6.27",
"1.6.28",
"1.6.29",
"1.6.3",
"1.6.30",
"1.6.31",
"1.6.32",
"1.6.33",
"1.6.34",
"1.6.35",
"1.6.36",
"1.6.36.1",
"1.6.37",
"1.6.38",
"1.6.39",
"1.6.4",
"1.6.40",
"1.6.41",
"1.6.42",
"1.6.43",
"1.6.44",
"1.6.45",
"1.6.46",
"1.6.47",
"1.6.5",
"1.6.6",
"1.6.7",
"1.6.8",
"1.6.9",
"2.0.0",
"2.0.0-beta.1",
"2.0.0-beta.10",
"2.0.0-beta.11",
"2.0.0-beta.12",
"2.0.0-beta.13",
"2.0.0-beta.14",
"2.0.0-beta.15",
"2.0.0-beta.16",
"2.0.0-beta.2",
"2.0.0-beta.3",
"2.0.0-beta.4",
"2.0.0-beta.5",
"2.0.0-beta.6",
"2.0.0-beta.7",
"2.0.0-beta.8",
"2.0.0-beta.9",
"2.0.1",
"2.0.10",
"2.0.11",
"2.0.12",
"2.0.13",
"2.0.14",
"2.0.15",
"2.0.16",
"2.0.17",
"2.0.18",
"2.0.19",
"2.0.2",
"2.0.20",
"2.0.21",
"2.0.22",
"2.0.23",
"2.0.23.1",
"2.0.24",
"2.0.25",
"2.0.25.1",
"2.0.26",
"2.0.27",
"2.0.27.1",
"2.0.28",
"2.0.29",
"2.0.3",
"2.0.30",
"2.0.31",
"2.0.32",
"2.0.33",
"2.0.34",
"2.0.34.1",
"2.0.35",
"2.0.36",
"2.0.37",
"2.0.38",
"2.0.39",
"2.0.4",
"2.0.40",
"2.0.41",
"2.0.42",
"2.0.43",
"2.0.44",
"2.0.44.1",
"2.0.45",
"2.0.5",
"2.0.6",
"2.0.7",
"2.0.8",
"2.0.9",
"2.1.0",
"2.1.1",
"2.1.10",
"2.1.11",
"2.1.12",
"2.1.13",
"2.1.14",
"2.1.15",
"2.1.16",
"2.1.17",
"2.1.18",
"2.1.19",
"2.1.2",
"2.1.20",
"2.1.21",
"2.1.22",
"2.1.23",
"2.1.24",
"2.1.25",
"2.1.26",
"2.1.27",
"2.1.28",
"2.1.29",
"2.1.3",
"2.1.30",
"2.1.31",
"2.1.32",
"2.1.33",
"2.1.34",
"2.1.35",
"2.1.36",
"2.1.37",
"2.1.38",
"2.1.39",
"2.1.4",
"2.1.40",
"2.1.41",
"2.1.42",
"2.1.43",
"2.1.44",
"2.1.45",
"2.1.46",
"2.1.47",
"2.1.48",
"2.1.49",
"2.1.5",
"2.1.50",
"2.1.51",
"2.1.52",
"2.1.6",
"2.1.7",
"2.1.8",
"2.1.9",
"2.2.0",
"2.2.1",
"2.2.10",
"2.2.11",
"2.2.12",
"2.2.13",
"2.2.14",
"2.2.15",
"2.2.16",
"2.2.17",
"2.2.18",
"2.2.19",
"2.2.2",
"2.2.20",
"2.2.21",
"2.2.22",
"2.2.23",
"2.2.24",
"2.2.25",
"2.2.26",
"2.2.27",
"2.2.28",
"2.2.29",
"2.2.3",
"2.2.30",
"2.2.4",
"2.2.5",
"2.2.6",
"2.2.7",
"2.2.8",
"2.2.9",
"3.0.0",
"3.0.0-beta.1",
"3.0.0-beta.10",
"3.0.0-beta.11",
"3.0.0-beta.12",
"3.0.0-beta.13",
"3.0.0-beta.14",
"3.0.0-beta.15",
"3.0.0-beta.16",
"3.0.0-beta.17",
"3.0.0-beta.18",
"3.0.0-beta.19",
"3.0.0-beta.2",
"3.0.0-beta.20",
"3.0.0-beta.3",
"3.0.0-beta.4",
"3.0.0-beta.5",
"3.0.0-beta.6",
"3.0.0-beta.7",
"3.0.0-beta.8",
"3.0.0-beta.9",
"3.0.1",
"3.0.10",
"3.0.11",
"3.0.12",
"3.0.13",
"3.0.14",
"3.0.15",
"3.0.16",
"3.0.17",
"3.0.18",
"3.0.19",
"3.0.2",
"3.0.20",
"3.0.21",
"3.0.22",
"3.0.23",
"3.0.24",
"3.0.25",
"3.0.26",
"3.0.27",
"3.0.28",
"3.0.29",
"3.0.3",
"3.0.30",
"3.0.31",
"3.0.32",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"3.1.0",
"3.1.1",
"3.1.10",
"3.1.11",
"3.1.12",
"3.1.13",
"3.1.14",
"3.1.15",
"3.1.16",
"3.1.17",
"3.1.18",
"3.1.19",
"3.1.2",
"3.1.20",
"3.1.21",
"3.1.22",
"3.1.23",
"3.1.24",
"3.1.25",
"3.1.26",
"3.1.3",
"3.1.4",
"3.1.5",
"3.1.6",
"3.1.7",
"3.1.8",
"3.1.9"
]
}