CVE-2026-73858
Received Received - Intake

Stored XSS in Solspace Freeform Plugin for Craft CMS

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-73858
EUVD
EUVD-2026-85334

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
solspace freeform From 5.0.0 (inc) to 5.10.13 (inc)
solspace freeform 5.10.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server Side Template Injection (SSTI) vulnerability in the Solspace Freeform plugin for Craft CMS. It affects versions 5.0.0 through 5.10.13. An unauthenticated attacker can submit Twig expressions in public form fields. These expressions are evaluated when rendered back into the form response, potentially exposing limited server or environment information like PHP version, OS, or filesystem paths.

Detection Guidance

To detect this vulnerability, check if your Craft CMS with Solspace Freeform plugin is running versions 5.0.0 through 5.10.13. Inspect form submissions for Twig expressions in field values or HTML attributes. Use commands like curl to submit test payloads to forms and observe responses for evaluated PHP or system constants. Ensure your Freeform plugin is updated to version 5.10.14 or later.

Impact Analysis

The impact is limited to server and environment information disclosure. Attackers may learn PHP version, operating system details, or absolute filesystem paths. It does not allow access to sensitive data like credentials or remote code execution. Rendering errors may also occur.

Compliance Impact

This vulnerability may lead to limited server and environment information disclosure, such as PHP version, OS, or filesystem paths. While it does not directly expose sensitive data like credentials or environment variables, such disclosures could potentially violate compliance requirements under GDPR or HIPAA if they reveal system details that aid in further attacks or indicate inadequate security controls.

Mitigation Strategies

Update the Solspace Freeform plugin for Craft CMS to version 5.10.14 or later to patch the vulnerability.

  • Check the current version of Freeform installed on your system and upgrade if it is below 5.10.14.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73858. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart