CVE-2026-105950

getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

State: Published
Severity: 5.1 Medium
Published: Oct 6, 2026
Updated: Oct 6, 2026
Reserved: Oct 6, 2026

Description

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X	VulDB
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
formworkgetformwork	2.3.0Affected 2.3.1Affected 2.3.2Affected 2.3.3Affected 2.3.4Affected 2.3.5Affected 2.3.6Affected 2.3.7Affected 2.3.8Affected 2.3.9Affected 2.3.10Affected 2.3.11Affected 2.3.12Affected 2.3.13Not affected

References

VDB-413925 | getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scriptingvdb-entrytechnical-description
VDB-413925 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-105950 | CVE Analysis and Reportthird-party-advisory
Submit #992820 | Formwork Formwork CMS 2.3.12 Stored Cross-Site Scripting (CWE-79)third-party-advisory
https://github.com/getformwork/formwork/security/advisories/GHSA-p78q-v3pr-p87jrelated
https://github.com/getformwork/formwork/pull/940issue-trackingpatch
https://github.com/getformwork/formwork/commit/729701e59c5886685c5a1d477bdc3035e41f18b1patch
https://github.com/getformwork/formwork/releases/tag/2.3.13patch
https://github.com/getformwork/formwork/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.