CVE-2026-52889 in Formie Plugin
Summary
by MITRE • 08/19/2026
Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form rendering. An unauthenticated attacker can place Twig syntax in one of these request-controlled inputs when a public form contains an affected Hidden field. Hidden::getFrontEndInputOptions() then assigns the value to defaultValue and calls renderString, causing server-side template evaluation rather than treating the request data as a plain string. Depending on the Craft site configuration and available Twig capabilities, exploitation can disclose sensitive information, modify application state, or achieve remote code execution. This issue is fixed in version 3.1.27.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in Formie, specifically affecting versions prior to 3.1.27 for Craft CMS, represents a critical server-side template injection flaw that stems from improper handling of user-supplied input within hidden form fields. As a widely used plugin for creating forms on the Craft CMS platform, Formie processes various request-derived data points such as HTTP User Agent strings, Referer URLs, current URL paths without query parameters, specific query parameter values, and cookie contents to populate default values for hidden fields during front-end rendering. The core technical flaw lies in how these dynamic inputs are processed before being passed to the Twig templating engine. Instead of sanitizing or escaping this data as plain text strings, the application assigns the raw request-derived value directly to a defaultValue property within the Hidden field logic. This design oversight allows an attacker who can control any of these specific input vectors to inject arbitrary Twig syntax into the form structure.
From an operational perspective, the exploitation mechanism relies on the interaction between the Formie plugin and Craft CMS's rendering layer. When a public-facing form contains a hidden field configured to use one of the affected dynamic default sources, such as the Referer URL or Query Parameter, an unauthenticated attacker can craft a request containing malicious Twig code within that specific input parameter. Upon submission or page load, the Formie plugin retrieves this tainted value and passes it directly to Craft's renderString function. This function is designed to evaluate template syntax rather than output literal strings. Consequently, instead of displaying the injected payload as static text on the web page, the server executes the Twig code embedded within the request data. This behavior transforms a standard input field into an execution vector for arbitrary commands defined by the attacker, bypassing traditional authentication requirements since the attack surface is exposed through public-facing form interactions.
The impact of this vulnerability is severe and multifaceted, primarily categorized under CWE-94 as Improper Control of Generation of Code or Script, commonly known as Server-Side Template Injection. Depending on the specific configuration of the underlying Craft CMS installation and the capabilities enabled within its Twig environment, an attacker can achieve Remote Code Execution with the privileges of the web server process. This level of access allows for complete compromise of the application's integrity and confidentiality. Attackers may use this vector to exfiltrate sensitive data stored in the database, modify application state by altering configuration files or user records, or establish persistent backdoors within the system. The ability to execute arbitrary code effectively neutralizes many standard web security controls that rely on input validation at the presentation layer, as the execution occurs server-side during template rendering.
In terms of threat modeling and industry standards, this vulnerability aligns with MITRE ATT&CK techniques related to Server-Side Request Forgery or Injection-based attacks where initial access is gained through unauthenticated vectors leading to code execution. The attack path typically involves reconnaissance followed by exploitation via the web application interface without requiring valid credentials, highlighting a significant gap in input validation for dynamic form fields. To mitigate this risk, organizations using Formie must immediately upgrade to version 3.1.27 or later, where the developers have implemented proper escaping and sanitization measures to ensure that request-derived data is treated strictly as plain text when assigned to hidden field defaults. Additionally, administrators should review their Twig configurations to disable dangerous functions if possible, although upgrading the plugin remains the primary and most effective remediation strategy given the depth of integration with the CMS core rendering engine.