CVE-2026-45697
Formie: Pre-authenticated server-side template injection in Hidden fields
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Formie: Pre-authenticated server-side template injection in Hidden fields
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.
- Record
CVE-2026-45697- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-693, CWE-1336
- Updated
- 2026-11-02
EUVDEUVD-2026-33421
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.
- Record
EUVD-2026-33421- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x7m9-mwc2-g6w2
Formie: Pre-authenticated server-side template injection in Hidden fields
Impact
- Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior).
- Sites with public Formie forms that include at least one Hidden field with that configuration.
- No CP login for the reported chain.
Patches
Workarounds
- Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible
- Otherwise, upgrade to patched versions
- Record
GHSA-x7m9-mwc2-g6w2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-693, CWE-1336
- Updated
- 2026-11-02
NVD
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.
- Record
CVE-2026-45697- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-693, CWE-1336
- Updated
- 2026-11-02
OSV
Formie: Pre-authenticated server-side template injection in Hidden fields
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.
- Record
CVE-2026-45697- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1336, CWE-693, CWE-94
- Updated
- 2026-11-02
OSVGHSA-x7m9-mwc2-g6w2
Formie: Pre-authenticated server-side template injection in Hidden fields
Impact
- Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior).
- Sites with public Formie forms that include at least one Hidden field with that configuration.
- No CP login for the reported chain.
Patches
Workarounds
- Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible
- Otherwise, upgrade to patched versions
- Record
GHSA-x7m9-mwc2-g6w2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1336, CWE-693, CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
verbb/formiePackagist |
3.0.0-beta.1 up to 3.1.24 | 3.1.24 |
verbb/formiePackagist |
before 2.2.20 | 2.2.20 |
verbb/formiePackagist |
3.0.0-beta.1 up to 3.1.24, plus listed versions 3.0.03.0.0-beta.103.0.0-beta.113.0.0-beta.123.0.0-beta.13 Show 45 moreShow less3.0.0-beta.143.0.0-beta.153.0.0-beta.163.0.0-beta.173.0.0-beta.183.0.0-beta.193.0.0-beta.23.0.0-beta.203.0.0-beta.33.0.0-beta.43.0.0-beta.53.0.0-beta.63.0.0-beta.73.0.0-beta.83.0.0-beta.93.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.213.0.223.0.233.0.243.0.253.0.263.0.273.0.283.0.293.0.33.0.303.0.313.0.323.0.43.0.53.0.63.0.7 |
3.1.24 |
verbb/formiePackagist |
before 2.2.20, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 45 moreShow less1.0.51.0.61.0.71.0.81.0.91.0.9.11.1.01.1.11.1.1.11.1.21.1.31.1.41.1.4.11.1.51.1.61.1.71.1.81.2.01.2.11.2.101.2.111.2.121.2.131.2.141.2.151.2.161.2.171.2.181.2.191.2.21.2.201.2.211.2.221.2.231.2.23.11.2.241.2.251.2.261.2.271.2.281.2.31.2.41.2.51.2.61.2.7 |
2.2.20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-45697 is a critical vulnerability (CVSS 9.8) in Verbb Formie, published May 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in verbb/formie 3.1.24.
References
github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2
nvd.nist.gov/vuln/detail/CVE-2026-45697
Left out here: 301 versions. The JSON record has them.