CVE-2026-105950
Deferred Deferred - Pending Action

Cross-Site Scripting in getformwork Formwork

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: VulDB

Description
A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-105950
EUVD
EUVD-2026-93467

Affected Vendors & Products

Showing 13 associated CPEs
Vendor Product Version / Range
getformwork formwork 2.3.0
getformwork formwork 2.3.1
getformwork formwork 2.3.2
getformwork formwork 2.3.3
getformwork formwork 2.3.4
getformwork formwork 2.3.5
getformwork formwork 2.3.6
getformwork formwork 2.3.7
getformwork formwork 2.3.8
getformwork formwork 2.3.9
getformwork formwork 2.3.10
getformwork formwork 2.3.11
getformwork formwork 2.3.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in getformwork formwork versions up to 2.3.12. It occurs in the DomSanitizer::sanitizeNodeAttribute function of the URI Sanitizer component. The flaw allows remote attackers to inject malicious scripts via manipulation of the formaction argument.

Detection Guidance

The vulnerability is specific to getformwork formwork versions up to 2.3.12. Check installed version with: composer show getformwork/formwork. If version is <=2.3.12, the system is vulnerable.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in a victim's browser, potentially stealing session cookies, redirecting users to malicious sites, or performing actions on their behalf. The impact depends on user privileges and application context.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity. Compliance risks include data breaches and unauthorized access.

Mitigation Strategies

Upgrade getformwork formwork to version 2.3.13 or later immediately. The patch is identified as 729701e59c5886685c5a1d477bdc3035e41f18b1.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105950. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart