CVE-2026-45697criticalCWE-1336CWE-693CWE-94

CVE-2026-45697: falha crítica em verbb formie

Formie: Pre-authenticated server-side template injection in Hidden fields

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar formie+ Monitorar verbb/formie

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.5%
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
verbb · formie
CVEs relacionadas — verbb formie

No mesmo produto, das mais perigosas para as menos.

CVE-2026-52889CRITICALFormie: Server-Side Template Injection in Formie Hidden field defaultsEPSS 1.3%CVE-2026-76086HIGHFormie: Integration form-settings action allows SSRF and exfiltration of stored integration credentialsEPSS 0.5%CVE-2026-76089HIGHFormie: Missing authorization on sent notification resend modal exposes submission PIIEPSS 0.4%CVE-2026-76087HIGHFormie: Unauthenticated users can overwrite incomplete submissions via submit actionEPSS 0.4%CVE-2026-47266HIGHFormie: Unauthenticated front-end submission editing can overwrite existing submissionsEPSS 0.3%CVE-2024-35191MEDIUMverbb/formie Server-Side Template Injection for variable-enabled settingsEPSS 0.3%