Server-Side Template Injection

solspace/craft-freeform is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper input handling because the submission title field in forms allows arbitrary code injection when edited by users with form editing access...

CVE-2025-52122

The Freeform plugin for CraftCMS (versions 5.0.0 to before 5.10.16 ) is vulnerable to Server-side template injection (SSTI) . The root cause is the improper handling of user input where the plugin implements a "call" Twig filter without sufficient validation on the form submission title field. An...