CVE-2025-52122: The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability
Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).
Published Aug 27, 2025
Affected packages
solspace/craft-freeform
- Ecosystem
- Composer (PHP)
- Affected
- >= 5.0.0, < 5.10.16
- Fixed in
- 5.10.16
- Check
composer show solspace/craft-freeform
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology