CVE-2025-64515: medium-severity vulnerability in open-formulieren open-forms
Open Forms prefill data in read-only components can be tampered
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.3%
Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
open-formulieren · open-formsRelated CVEs — open-formulieren open-forms
In the same product, most dangerous first.
CVE-2022-31041HIGHInsufficient content-type validation for uploaded files in open-formsEPSS 0.8%CVE-2022-31040HIGHOpen Redirect in open-formsEPSS 0.7%CVE-2024-24771HIGHOpen Forms potential multi-factor authentication bypassEPSS 0.6%CVE-2026-28803MEDIUMOpen Forms possible to view submission details of other people than intendedEPSS 0.2%
References
https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvf