Vulnerability · Published May 29, 2026 · Assigned by GitHub_M

CVE-2026-45697Formie: Pre-authenticated server-side template injection in Hidden fields

Critical 9.8

In plain English

A critical-severity code injection in formie from verbb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 58.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	verbb/formie	3.1.24	GHSA-x7m9-mwc2-g6w2
Packagist	verbb/formie	2.2.20	GHSA-x7m9-mwc2-g6w2

Affected products (as reported)

Vendor	Product	Versions
verbb	formie	< 2.2.20>= 3.0.0-beta.1, < 3.1.24

Weakness: CWE-94, CWE-693, CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2 x_refsource_CONFIRM
https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3 x_refsource_MISC
https://github.com/verbb/formie/releases/tag/2.2.20 x_refsource_MISC
https://github.com/verbb/formie/releases/tag/3.1.24 x_refsource_MISC