CVE-2026-73858

Name of the Vulnerable Software and Affected Versions Solspace Freeform plugin for Craft CMS versions 5.0.0 through 5.10.13

Description A Server-Side Template Injection (SSTI) occurs when submitted values from public forms are evaluated by the isolated Twig renderer while being rendered into HTML attributes. An unauthenticated attacker can inject Twig expressions into submitted field values, such as value attributes, to retrieve evaluated PHP, operating-system, or Craft filesystem-path constants in the response. This leads to the disclosure of server and environment information and may cause rendering errors. SSTI is a vulnerability where an attacker injects malicious templates that are executed on the server side.

Recommendations Update Solspace Freeform plugin for Craft CMS to version 5.10.14.