CVE-2026-82451 in Formwork
Summary
by MITRE • 08/29/2026
Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/29/2026
The Formwork content management system, specifically through version 2.3.14, suffers from a critical stored cross-site scripting vulnerability within its visit tracking module. This flaw arises because the application fails to properly sanitize or encode user-supplied input before storing it in the backend database and subsequently rendering it on administrative interfaces. Specifically, the Referer HTTP header is captured during standard web requests and persisted as part of the site's analytics data without adequate validation against script injection patterns. While cross-site scripting vulnerabilities are often associated with immediate client-side execution via direct links or form submissions, this particular implementation classifies as a stored vulnerability because the malicious payload is saved on the server side rather than being transmitted solely in the request stream for temporary processing.
The technical mechanism of exploitation relies on an attacker crafting a specially crafted HTTP Referer header containing executable JavaScript code and directing a victim user to trigger its storage within the system's database. Although the initial injection point involves client-side interaction, the persistence of this data means that every subsequent access to the Statistics panel by authorized personnel will cause the browser to parse and execute the embedded script in the context of the administrative session. This behavior aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation as a classic cross-site scripting weakness. The severity is amplified because the vulnerability targets administrators who typically possess elevated privileges within the application environment.
From an operational perspective, this vulnerability poses a severe risk to the integrity and confidentiality of the Formwork installation. An unauthenticated attacker can leverage this flaw to execute arbitrary JavaScript code in the context of trusted administrative users. This capability allows for session hijacking, where the attacker steals authentication cookies or tokens to impersonate legitimate administrators without needing valid credentials. Furthermore, it enables data exfiltration, allowing the extraction of sensitive content managed by the CMS, such as user databases, configuration files, and proprietary media assets. The attack can also facilitate defacement of the administrative interface or serve as a pivot point for further network attacks if the administrator's browser is connected to internal resources that are accessible from the client machine.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically under sub-techniques involving JavaScript execution within a web browser context. It also relates to T1078, Valid Accounts, as it facilitates unauthorized access through credential theft or session manipulation. The lack of input validation on the Referer header represents a fundamental oversight in secure coding practices, highlighting the necessity for strict output encoding and input sanitization strategies across all data ingestion points within web applications.
To mitigate this vulnerability, immediate action is required to upgrade Formwork to version 2.3.15 or later where the issue has been addressed by implementing proper context-aware output encoding for all stored user inputs displayed in HTML contexts. Until an update is applied, administrators should restrict access to the Statistics panel using additional network-level controls such as IP whitelisting or multi-factor authentication to reduce the attack surface. Implementing a Web Application Firewall with rules capable of detecting and blocking malicious Referer headers containing script tags can provide temporary protection against exploitation attempts. Long-term remediation involves adopting secure development lifecycle practices that mandate rigorous input validation, output encoding, and content security policy implementation to prevent similar injection flaws in future releases.