TI-2026-33438 Aliases CVE-2026-45697 GHSA-x7m9-mwc2-g6w2

Formie: Pre-authenticated server-side template injection in Hidden fields

MEDIUM 49CWE-1336Published 2026-05-29 · Updated 2026-06-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution, Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336 and CWE-693.

Summary

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00475 41st percentileScored 2026-11-07

Fix Fixed formie (verbb): 2.2.20, 3.1.24verbb/formie (Packagist): 3.1.24, 2.2.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
verbb	formie	before 2.2.20; 3.0.0-beta.1 to before 3.1.24	2.2.20, 3.1.24	Patch available	CNA
—	verbb/formie (Packagist)	3.0.0-beta.1 to before 3.1.24	3.1.24	Patch available	GHSA-x7m9-mwc2-g6w2
—	verbb/formie (Packagist)	before 2.2.20	2.2.20	Patch available	GHSA-x7m9-mwc2-g6w2

formie Vendorverbb Affected before 2.2.20; 3.0.0-beta.1 to before 3.1.24 Fixed in 2.2.20, 3.1.24 Patch available CNA
verbb/formie (Packagist) Vendor— Affected 3.0.0-beta.1 to before 3.1.24 Fixed in 3.1.24 Patch available GHSA-x7m9-mwc2-g6w2
verbb/formie (Packagist) Vendor— Affected before 2.2.20 Fixed in 2.2.20 Patch available GHSA-x7m9-mwc2-g6w2

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:verbb:formie::::::::	—	—	verbb

cpe:2.3:a:verbb:formie:*:*:*:*:*:*:*:* Versions — — ·verbb

Remediation

Fix · CNA formie (verbb) Fixed in 2.2.20, 3.1.24
Fix · GHSA-x7m9-mwc2-g6w2 verbb/formie (Packagist) Fixed in 3.1.24 Advisory →
Fix · GHSA-x7m9-mwc2-g6w2 verbb/formie (Packagist) Fixed in 2.2.20 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-45697
2026-10-03 Alias added: GHSA-x7m9-mwc2-g6w2
2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-45697

Other 5

TI-2026-37985 Formie: Server-Side Template Injection in Formie Hidden field defaults CVSS 3.1CRITICAL 9.8
TI-2026-34846 Formie: Unauthenticated front-end submission editing can overwrite existing submissions CVSS 4.0HIGH 8.7
TI-2026-53255 Formie: Unauthenticated users can overwrite incomplete submissions via submit action CVSS 3.1HIGH 8.2
TI-2020-10575 The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header. CVSS 3.1CRITICAL 9.1
TI-2020-10552 An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. CVSS 3.1HIGH 8.8
TI-2026-53254 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials CVSS 3.1HIGH 8.5

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences