CVE-2026-103542
MediumCVSS 4.3Summary
A server-side request forgery (SSRF) vulnerability exists in Form Tools up to 3.1.1 in the smart_fill function of /global/code/actions.php (AJAX Endpoint component). Manipulation of the url argument allows server-side requests. The exploit is publicly disclosed and can be triggered remotely.
Risk Assessment
An attacker could use the server to scan and access internal network resources, potentially leading to data leakage or further attack escalation. The project has not responded to the report, so a fix may not be available.
Recommendation
If possible, upgrade Form Tools beyond 3.1.1 or apply mitigations by restricting access to the smart_fill function and validating the url argument. Monitor outbound traffic from the server for unusual requests.
Other vulnerabilities in Form Tools
See all- CVE-2026-103541Medium
An unrestricted file upload vulnerability exists in Form Tools up to 3.1.1 in the Files::uploadFile function of global/code/actions.php (Ajax Handler component). Manipulation allows remote upload of arbitrary files. The exploit is public and may be used.
- CVE-2026-103540Medium
A vulnerability exists in Form Tools up to 3.1.1 in the Clients::updateClientSettingsTab function of global/code/Clients.class.php (Client Settings component). Manipulation of the page_titles argument leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely and the exploit is publicly disclosed.
Original NVD description (English source)
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS