GHSA-vf6x-59hh-332f
Formwork has a cross-site scripting (XSS) vulnerability in Site title
Summary
The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.
Impact
The attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.
Patches
- Formwork 2.x (aa3e9c6) escapes site title from panel header navigation.
Details
By embedding "<!--", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
What each source reports
GitHub Advisories Score used
Formwork has a cross-site scripting (XSS) vulnerability in Site title
Summary
The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.
Impact
The attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.
Patches
- Formwork 2.x (aa3e9c6) escapes site title from panel header navigation.
Details
By embedding "<!--", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.
- Record
GHSA-vf6x-59hh-332f- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-80
- Updated
- 2026-11-02
OSV
Formwork has a cross-site scripting (XSS) vulnerability in Site title
Summary
The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.
Impact
The attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.
Patches
- Formwork 2.x (aa3e9c6) escapes site title from panel header navigation.
Details
By embedding "<!--", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.
- Record
GHSA-vf6x-59hh-332f- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-80
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
getformwork/formworkPackagist | 2.0.0-beta.3 to 2.0.0-beta.3 | 2.0.0-beta.4 |
getformwork/formworkPackagist | 2.0.0-beta.3 up to 2.0.0-beta.4 | 2.0.0-beta.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-vf6x-59hh-332f is a medium vulnerability (CVSS 4.7) in getformwork/formwork, published March 1, 2025. No source lists public exploit code. Fixed in getformwork/formwork 2.0.0-beta.4.