CVE-2026-45697: Formie: Pre-authenticated server-side template injection in Hidden fields

Synopsis

Server-side template injection in Formie, a Craft CMS plugin for building forms. The bug is reachable over the network without authentication: an unauthenticated attacker can submit crafted values into Hidden fields whose Default value is set to Custom, and those values are evaluated as Twig during submission handling. Successful exploitation can lead to remote code execution, disclosure of site data, and tampering with the Craft installation, with patched-image rebuilds at Formie 2.2.20 and 3.1.24 available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the form submission endpoint over the network, which is typically exposed on any public Craft CMS site running Formie.

• AuthenticationNot required

  No account or credentials are needed; any anonymous visitor who can POST a form submission can trigger the injection.

• Victim interactionNot required

  Exploitation is driven entirely by the attacker's submission and requires no action from a site user or administrator.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and free of race conditions or environmental prerequisites, though final impact depends on the site's Twig sandbox configuration.

Blast Radius

• Executes attacker-controlled Twig in the context of the Craft CMS application, which on many configurations leads to arbitrary code execution on the web server.
• Reads site secrets, database credentials, and stored content accessible to the Craft process.
• Modifies or deletes Craft content, form submissions, and other persisted records.
• Can disrupt or take the Craft site offline by tampering with application state or crashing the PHP worker.