CVE-2026-45697

Formie: Pre-authenticated server-side template injection in Hidden fields

State: Published
Severity: 9.8 Critical
Published: May 29, 2026
Updated: Jun 1, 2026
Reserved: May 13, 2026

Description

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-693 Protection Mechanism Failure
CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

Affected Products

Product	Versions
formieverbb	< 2.2.20Affected >= 3.0.0-beta.1, < 3.1.24Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.