CVE-2026-45697: Formie: Pre-authenticated server-side template injection in Hidden fields
Impact - Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). - Sites with public Formie forms that include at least one Hidden field with that configuration. - No CP login for the reported chain.
Published May 18, 2026 · Updated Jun 9, 2026
Affected packages
verbb/formie
- Ecosystem
- Composer (PHP)
- Affected
- >= 3.0.0-beta.1, < 3.1.24
- Fixed in
- 3.1.24
- Check
composer show verbb/formie
verbb/formie
- Ecosystem
- Composer (PHP)
- Affected
- < 2.2.20
- Fixed in
- 2.2.20
- Check
composer show verbb/formie
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
- Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior).
- Sites with public Formie forms that include at least one Hidden field with that configuration.
- No CP login for the reported chain.
Patches
Workarounds
- Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible
- Otherwise, upgrade to patched versions
Credited to pwnsauc3.
References
- https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2
- https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3
- https://github.com/verbb/formie/releases/tag/2.2.20
- https://github.com/verbb/formie/releases/tag/3.1.24
- https://nvd.nist.gov/vuln/detail/CVE-2026-45697
- https://github.com/advisories/GHSA-x7m9-mwc2-g6w2
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology