Read the docs
TI-2026-68481 Aliases CVE-2026-105950GHSA-3j63-cg5x-w8f2

Cross-site scripting in getformwork Formwork URI sanitizer

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

getformwork Formwork versions from 2.3.0 before 2.3.13 are affected. The URI sanitizer in DomSanitizer::sanitizeNodeAttribute does not neutralize input in the formaction argument, which allows cross-site scripting (CWE-79). A remote attacker with low privileges can trigger it, but a user must interact with the crafted content.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed formwork (getformwork): 2.3.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getformworkformwork2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.5; 2.3.6; 2.3.7; 2.3.8; 2.3.9; 2.3.10; 2.3.11; 2.3.122.3.13Patch availableCNA
  • formwork Vendorgetformwork Affected 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.5; 2.3.6; 2.3.7; 2.3.8; 2.3.9; 2.3.10; 2.3.11; 2.3.12 Fixed in 2.3.13 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:getformwork:formwork:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:getformwork:formwork:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade Formwork to version 2.3.13, which the vendor recommends. The fix is included in patch 729701e59c5886685c5a1d477bdc3035e41f18b1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA formwork (getformwork) Fixed in 2.3.13

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105950
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-06 Alias added: GHSA-3j63-cg5x-w8f2

References

Patch 3

Other 2

  • TI-2025-40524 Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags CVSS 3.1MEDIUM 6.5
  • TI-2023-09940 A stored cross-site scripting (XSS) vulnerability in the component… CVSS 3.1MEDIUM 4.8
  • TI-2026-21635 Formwork Improperly Manages Privileges During User Creation CVSS 3.1HIGH 8.8
  • TI-2026-67389 Formwork before 2.3.13 Path Traversal via BackupController Download and Delete CVSS 4.0HIGH 7.1
  • TI-2026-56848 Formwork < 2.3.11 Stored XSS via Referer Header CVSS 4.0MEDIUM 5.3
  • TI-2024-24687 Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences