PT-2024-26371 · Formie · Formie

Name of the Vulnerable Software and Affected Versions: Formie versions prior to 2.1.6 Description: The issue allows users with access to a form's settings to include malicious Twig code into fields that support Twig, such as the Submission Title or the Success Message. This code will then be...

CVE-2024-35191: Improper Neutralization of Special Elements Used in a Template Engine

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or renderi...