CVE-2026-45697criticalCWE-1336CWE-693CWE-94

CVE-2026-45697: critical vulnerability in verbb formie

Formie: Pre-authenticated server-side template injection in Hidden fields

Published · Updated

Follow this CVE+ Monitor formie+ Monitor verbb/formie

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.5%
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
verbb · formie
Related CVEs — verbb formie

In the same product, most dangerous first.

CVE-2026-52889CRITICALFormie: Server-Side Template Injection in Formie Hidden field defaultsEPSS 1.3%CVE-2026-76086HIGHFormie: Integration form-settings action allows SSRF and exfiltration of stored integration credentialsEPSS 0.5%CVE-2026-76089HIGHFormie: Missing authorization on sent notification resend modal exposes submission PIIEPSS 0.4%CVE-2026-76087HIGHFormie: Unauthenticated users can overwrite incomplete submissions via submit actionEPSS 0.4%CVE-2026-47266HIGHFormie: Unauthenticated front-end submission editing can overwrite existing submissionsEPSS 0.3%CVE-2024-35191MEDIUMverbb/formie Server-Side Template Injection for variable-enabled settingsEPSS 0.3%