CVE-2026-103540
Received Received - Intake

Improper Neutralization of Template Elements in Form Tools

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: VulDB

Description
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-103540
EUVD
EUVD-2026-90497

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
formtools form_tools to 3.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
CWE-791 The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-103540 is a Server-Side Template Injection (SSTI) vulnerability in FormTools version 3.1.1. It occurs in the Clients::updateClientSettingsTab() function where the page_titles parameter is saved without checking user permissions. Attackers can inject malicious Smarty template code via the page_settings.php endpoint. When rendered, this code executes server-side, allowing file reads or PHP code execution.

Detection Guidance

To detect this vulnerability, check if FormTools 3.1.1 or earlier is installed. Look for unauthorized POST requests to /clients/account/index.php with parameters like update_account_settings=1 and page=settings. Inspect the page_titles parameter for Smarty template tags such as {fetch file='/etc/passwd'} or {include_php file='...'}. Review server logs for file reads or PHP code execution attempts.

Impact Analysis

An attacker with a valid FormTools account can exploit this to read sensitive files like /etc/passwd or global/config.php containing database credentials. They may also execute arbitrary PHP code on the server, leading to full system compromise. The attack requires only a logged-in account and works even for low-privilege clients.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized data access and potential exposure of sensitive personal information. GDPR requires protection of personal data while HIPAA mandates safeguards for protected health information. A successful exploit could lead to data breaches, resulting in regulatory fines and legal consequences.

Mitigation Strategies

Immediately update FormTools to the latest version if available. Disable the page_titles setting or enforce the may_edit_page_titles permission check. Enable Smarty security mode and disable dangerous template functions like {fetch} and {include_php}. Treat page_titles as plain text and review server configurations to prevent template injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103540. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart