CVE-2026-52889
Received Received - Intake

SSTI via Hidden Field in Formie Craft CMS Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form rendering. An unauthenticated attacker can place Twig syntax in one of these request-controlled inputs when a public form contains an affected Hidden field. Hidden::getFrontEndInputOptions() then assigns the value to defaultValue and calls renderString, causing server-side template evaluation rather than treating the request data as a plain string. Depending on the Craft site configuration and available Twig capabilities, exploitation can disclose sensitive information, modify application state, or achieve remote code execution. This issue is fixed in version 3.1.27.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-52889
EUVD
EUVD-2026-62518

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
formie formie 3.1.27
verbb formie From 3.0.0-beta.1 (inc) to 3.1.27 (exc)
verbb formie to 3.1.27 (exc)
verbb formie 3.1.27

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Template Injection (SSTI) vulnerability in the Formie plugin for Craft CMS. It affects versions 3.0.0-beta.1 through 3.1.26. Hidden fields using dynamic default values from HTTP requests (like User Agent, Referer URL, or Cookie Values) were passed directly to Craft's Twig rendering engine. Attackers could inject arbitrary Twig code to execute server-side commands, leading to data breaches, system changes, or full remote code execution.

Detection Guidance

Check Formie plugin version with composer show verbb/formie. Inspect Hidden fields in public forms for request-derived default values like User Agent, Referer URL, or Query Parameters. Review server logs for unusual Twig template evaluation errors or unexpected code execution traces.

Impact Analysis

An unauthenticated attacker could exploit this to access sensitive data, modify application settings, or run malicious code on the server. This depends on the Craft CMS configuration and available Twig functions. The impact ranges from information disclosure to complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection. A successful exploit may result in data breaches, triggering legal penalties, compliance violations, and reputational damage for organizations handling sensitive information.

Mitigation Strategies

Upgrade Formie to version 3.1.27 or later. Remove or disable Hidden fields using request-derived default values on public forms. Avoid using dynamic request data as default values in Hidden fields until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52889. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart