En resumen
- CVE-2026-45697 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a verbb/formie.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.47%, mayor que el 41.1% de las vulnerabilidades.
- Solución: actualizar a 3.1.24, 2.2.20 o posterior.
| Package | Affected versions | Patched versions |
|---|
| verbb/formie Packagist | ≥ 3.0.0-beta.1, < 3.1.24< 2.2.20
| 3.1.242.2.20
|
Description
Impact
- Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior).
- Sites with public Formie forms that include at least one Hidden field with that configuration.
- No CP login for the reported chain.
Patches
Workarounds
- Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible
- Otherwise, upgrade to patched versions
NVD description
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free