GHSA-x7m9-mwc2-g6w2critical9.8
Formie: Pre-authenticated server-side template injection in Hidden fields
Impact
- Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). - Sites with public Formie forms that include at least one Hidden field with that configuration. - No CP login for the reported chain.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
verbb/formie Packagist
| Affected range | Recorded fix |
|---|---|
| From 3.0.0-beta.1 before 3.1.24Ecosystem versions | 3.1.24 |
| Earlier releases before 2.2.20Ecosystem versions | 2.2.20 |
Version evidence: OSV · GHSA-x7m9-mwc2-g6w2
View original version evidence (402 explicit versions)
Original source description
Impact
- Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior).
- Sites with public Formie forms that include at least one Hidden field with that configuration.
- No CP login for the reported chain.
Patches
Workarounds
- Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible
- Otherwise, upgrade to patched versions
References
- Security advisory github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2
- Security advisory nvd.nist.gov/vuln/detail/CVE-2026-45697
- Patch github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3
- Source reference github.com/verbb/formie
- Release notes github.com/verbb/formie/releases/tag/2.2.20
- Release notes github.com/verbb/formie/releases/tag/3.1.24