CVE-2026-103540
MediumCVSS 6.3Summary
A vulnerability exists in Form Tools up to 3.1.1 in the Clients::updateClientSettingsTab function of global/code/Clients.class.php (Client Settings component). Manipulation of the page_titles argument leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely and the exploit is publicly disclosed.
Risk Assessment
An attacker could inject malicious template code, potentially leading to server-side code execution or data disclosure. The project has not responded, so a fix may not be available.
Recommendation
Upgrade Form Tools beyond 3.1.1 if available, or restrict access to the updateClientSettingsTab function and validate the page_titles argument. Monitor logs for unusual requests.
Other vulnerabilities in Form Tools
See all- CVE-2026-103542Medium
A server-side request forgery (SSRF) vulnerability exists in Form Tools up to 3.1.1 in the smart_fill function of /global/code/actions.php (AJAX Endpoint component). Manipulation of the url argument allows server-side requests. The exploit is publicly disclosed and can be triggered remotely.
- CVE-2026-103541Medium
An unrestricted file upload vulnerability exists in Form Tools up to 3.1.1 in the Files::uploadFile function of global/code/actions.php (Ajax Handler component). Manipulation allows remote upload of arbitrary files. The exploit is public and may be used.
Original NVD description (English source)
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS