Read the docs
TI-2024-23264 Aliases CVE-2024-35191GHSA-v45m-hxqp-fwf5

verbb/formie Server-Side Template Injection for variable-enabled settings

Priority LOW 20CWE-1336Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.

Summary

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This has been fixed in Formie 2.1.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00253 16th percentileScored 2026-11-07
Fix Fixed formie (verbb): 2.1.6verbb/formie (Packagist): 2.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
verbbformiebefore 2.1.62.1.6Patch availableCNA
—verbb/formie (Packagist)before 2.1.62.1.6Patch availableGHSA-v45m-hxqp-fwf5
  • formie Vendorverbb Affected before 2.1.6 Fixed in 2.1.6 Patch available CNA
  • verbb/formie (Packagist) Vendor— Affected before 2.1.6 Fixed in 2.1.6 Patch available GHSA-v45m-hxqp-fwf5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:verbb:formie:*:*:*:*:*:craft_cms:*:*before 2.0.44; 2.1.0 to before 2.1.6Vulnerableverbb
  • cpe:2.3:a:verbb:formie:*:*:*:*:*:craft_cms:*:* Versions before 2.0.44; 2.1.0 to before 2.1.6 Vulnerable ·verbb

Remediation

  • Fix · CNA formie (verbb) Fixed in 2.1.6
  • Fix · GHSA-v45m-hxqp-fwf5 verbb/formie (Packagist) Fixed in 2.1.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-35191
  2. 2026-10-03 Alias added: GHSA-v45m-hxqp-fwf5

References

Patch 1

Advisory 2

Other 1

  • TI-2025-23498 Formie has a XSS vulnerability for importing forms CVSS 4.0MEDIUM 5.3
  • TI-2025-23497 Formie has a XSS vulnerability for email notification content for preview CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences