Solspace Freeform: Limited Twig template injection via submitted field values
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.
Summary
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| solspace | craft-freeform | 5.0.0 to before 5.10.14 | 5.10.14 | Patch available | CNA |
| — | solspace/craft-freeform (Packagist) | 5.0.0 to before 5.10.14 | 5.10.14 | Patch available | GHSA-gxrg-x694-283w |
- craft-freeform Vendorsolspace Affected 5.0.0 to before 5.10.14 Fixed in 5.10.14 Patch available CNA
- solspace/craft-freeform (Packagist) Vendor— Affected 5.0.0 to before 5.10.14 Fixed in 5.10.14 Patch available GHSA-gxrg-x694-283w
Remediation
- Fix · CNA craft-freeform (solspace) Fixed in 5.10.14
- Fix · GHSA-gxrg-x694-283w solspace/craft-freeform (Packagist) Fixed in 5.10.14 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73858
- 2026-10-03 Alias added: GHSA-gxrg-x694-283w
References
Other 5
- https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w
- https://github.com/solspace/craft-freeform/pull/1986
- https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b
- https://github.com/solspace/craft-freeform/releases/tag/v5.10.14
- https://github.com/solspace/craft-freeform
More solspace vulnerabilities
- TI-2025-32483 Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template… CVSS 3.1CRITICAL 9.8
- TI-2026-21179 Cross-site scripting in solspace craft-freeform CVSS 4.0MEDIUM 5.1
Sources
- CVE-2026-73858 · CVE Program
- CVE-2026-73858 · NVD
- FIRST EPSS
- GHSA-gxrg-x694-283w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences