CVE-2026-76089

Formie, a Craft CMS plugin for creating forms, before version 3.1.27 passes request-derived Hidden field defaults (e.g., User Agent, URL, query parameters) to Craft's Twig rendering layer. An unauthenticated attacker can place Twig syntax in these values, leading to server-side template evaluation (SSTI), potentially resulting in information disclosure, application state modification, or remote code execution.

Formie, a Craft CMS plugin, prior to versions 2.2.20 and 3.1.24 allows unauthenticated users to submit crafted values into Hidden fields that are evaluated as Twig during submission handling. This can lead to serious compromise of the Craft site.

In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed.

In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response.

The Formie plugin for Craft CMS before versions 2.2.21 and 3.1.26 allowed unauthenticated users to modify existing submissions by posting a known or guessed submission ID to the formie/submissions/save-submission endpoint.