CVE-2026-52889

Name of the Vulnerable Software and Affected Versions Formie versions 3.0.0-beta.1 through 3.1.26

Description Formie allows request-derived Hidden field defaults to be passed to the Twig rendering layer during front-end form rendering. An unauthenticated attacker can inject Twig syntax into request-controlled inputs—such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value—when a public form contains an affected Hidden field. The Hidden::getFrontEndInputOptions() function assigns these values to defaultValue and calls renderString, leading to server-side template evaluation (SSTE) instead of treating the data as a plain string. Depending on the site configuration, this can result in the disclosure of sensitive information, modification of application state, or remote code execution.

Recommendations Update Formie to version 3.1.27 or later. As a temporary workaround, avoid using request-derived Hidden field defaults on public forms, including HTTP User Agent, HTTP Refer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value. Alternatively, remove affected Hidden fields from public forms until the update is applied.