CVE-2026-45697

Deferred
Published: 29 May 2026, 19:01
Last modified:29 May 2026, 19:01

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

29 May 2026, 19:01
Published
Vulnerability first disclosed

Description

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Techniques & Countermeasures

  • CWE-94•Improper Control of Generation of Code ('Code Injection')

    The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

  • CWE-693•Protection Mechanism Failure

    The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

  • CWE-1336•Improper Neutralization of Special Elements Used in a Template Engine

    The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Affected Systems

  • verbb•formie

    < 2.2.20 | ≥ 3.0.0-beta.1, < 3.1.24

References (4)