Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by VulDB

CVE-2026-105950getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in formwork from getformwork. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.2%top 85.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.

Affected products (as reported)

VendorProductVersions
getformwork formwork 2.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.7

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

References