Description

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form rendering. An unauthenticated attacker can place Twig syntax in one of these request-controlled inputs when a public form contains an affected Hidden field. Hidden::getFrontEndInputOptions() then assigns the value to defaultValue and calls renderString, causing server-side template evaluation rather than treating the request data as a plain string. Depending on the Craft site configuration and available Twig capabilities, exploitation can disclose sensitive information, modify application state, or achieve remote code execution. This issue is fixed in version 3.1.27.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-19T15:17:09.957Z",
  "pubdate": "2026-08-19T15:17:09.957Z",
  "executiveSummary": "The Formie plugin for Craft CMS suffers from a Server-Side Template Injection (SSTI) vulnerability due to improper handling of request-derived hidden field defaults prior to version 3.1.27.\nThe vulnerability allows unauthenticated remote attackers to inject arbitrary Twig template syntax via request parameters such as HTTP User Agent, Referer URL, Current URL, Query Parameters, or Cookie Values when a public form utilizes affected hidden fields.\nSuccessful exploitation of this flaw enables malicious actors to achieve severe impacts, including sensitive information disclosure, application state modification, and remote code execution (RCE) on the underlying server, depending on the Craft site configuration and available Twig capabilities.\nThe attack vector requires network access to a publicly accessible form containing a vulnerable hidden field configured to ingest request data without proper sanitization or context-aware escaping.\nRisk implications are critical, as the vulnerability can be leveraged by unauthenticated users to completely compromise the underlying web application and server infrastructure.\nMitigation requires updating the Formie plugin to version 3.1.27 or later, where the improper evaluation of request data within the Twig rendering layer has been remediated.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling of request-derived data within the Formie plugin for Craft CMS prior to version 3.1.27.\nSpecifically, the vulnerable component processes request-derived Hidden field defaults—including HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value—and passes them directly to Craft's Twig rendering layer during front-end form rendering.\nDuring execution, the Hidden::getFrontEndInputOptions() function assigns the request-controlled value to the defaultValue variable and subsequently invokes the renderString method.\nInstead of treating the incoming HTTP request data as a safe, plain string literal, the application evaluates the input as dynamic template code, resulting in Server-Side Template Injection (SSTI).\nThe attack flow proceeds as follows: an unauthenticated attacker crafts a malicious HTTP request containing arbitrary Twig syntax within request-controlled parameters such as a Cookie, User-Agent, or Query Parameter.\nWhen a user or the attacker interacts with a public form containing an affected Hidden field configured to capture this request data, the plugin retrieves the payload via Hidden::getFrontEndInputOptions().\nThe plugin then passes the unsanitized payload directly to the renderString function for server-side evaluation.\nBecause the input is processed by the Twig template engine, the embedded template directives are executed in the context of the server.\nDepending on the Craft site configuration and available Twig extensions or global variables, the post-exploitation impact ranges from reading sensitive environment variables and database credentials to executing arbitrary system commands, thereby achieving remote code execution.\nThe affected product is the Formie plugin for Craft CMS across versions prior to 3.1.27, requiring no prior authentication or specific privileges, and is exploitable over the network via standard HTTP interactions against public-facing forms."
}