CVE-2024-35191

Description

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This has been fixed in Formie 2.1.6.

Reserved 2024-05-10 | Published 2024-05-20 | Updated 2024-08-02 | Assigner GitHub_M

Problem types

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Product status

< 2.1.6
affected

References

github.com/...formie/security/advisories/GHSA-v45m-hxqp-fwf5

github.com/...ommit/90296edf7e707f117e760aa57e70dbd43a854420

cve.org (CVE-2024-35191)

nvd.nist.gov (CVE-2024-35191)

Download JSON