Read the docs
TI-2026-37985 Aliases CVE-2026-52889GHSA-565m-g33j-jq96

Formie: Server-Side Template Injection in Formie Hidden field defaults

Priority MEDIUM 51CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.

Summary

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form rendering. An unauthenticated attacker can place Twig syntax in one of these request-controlled inputs when a public form contains an affected Hidden field. Hidden::getFrontEndInputOptions() then assigns the value to defaultValue and calls renderString, causing server-side template evaluation rather than treating the request data as a plain string. Depending on the Craft site configuration and available Twig capabilities, exploitation can disclose sensitive information, modify application state, or achieve remote code execution. This issue is fixed in version 3.1.27.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01274 70th percentileScored 2026-11-07
Fix Fixed formie (verbb): 3.1.27verbb/formie (Packagist): 3.1.27

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
verbbformiebefore 3.1.273.1.27Patch availableCNA
—verbb/formie (Packagist)before 3.1.273.1.27Patch availableGHSA-565m-g33j-jq96
  • formie Vendorverbb Affected before 3.1.27 Fixed in 3.1.27 Patch available CNA
  • verbb/formie (Packagist) Vendor— Affected before 3.1.27 Fixed in 3.1.27 Patch available GHSA-565m-g33j-jq96

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:verbb:formie:*:*:*:*:*:*:*:*——verbb
  • cpe:2.3:a:verbb:formie:*:*:*:*:*:*:*:* Versions — — ·verbb

Remediation

  • Fix · CNA formie (verbb) Fixed in 3.1.27
  • Fix · GHSA-565m-g33j-jq96 verbb/formie (Packagist) Fixed in 3.1.27 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52889
  2. 2026-10-03 Alias added: GHSA-565m-g33j-jq96

References

Other 4

  • TI-2026-33438 Formie: Pre-authenticated server-side template injection in Hidden fields CVSS 3.1CRITICAL 9.8
  • TI-2026-34846 Formie: Unauthenticated front-end submission editing can overwrite existing submissions CVSS 4.0HIGH 8.7
  • TI-2026-53255 Formie: Unauthenticated users can overwrite incomplete submissions via submit action CVSS 3.1HIGH 8.2
  • TI-2020-10575 The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header. CVSS 3.1CRITICAL 9.1
  • TI-2020-10552 An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. CVSS 3.1HIGH 8.8
  • TI-2026-53254 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials CVSS 3.1HIGH 8.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences