CVE-2026-45697CWE-1336CWE-693CWE-94

Formie: Pre-authenticated server-side template injection in Hidden fields

Critical · published May 29, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
56.6
In the wild
Unconfirmed
What it is

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00813 · 56.6th percentile
Weaknesses
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine; CWE-693 · Protection Mechanism Failure; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-05-29T19:01Z
EPSS history
Timeline
  • 29 MAY 19:01Z
    Formie: Pre-authenticated server-side template injection in Hidden fields
    cvelistv5