External risk intelligence

Formie Plugin for Craft CMS Server-Side Template Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-52889

The vulnerability exists within a CMS plugin designed specifically for rendering forms on the front-end of websites. Because these forms are intended to be public-facing and interact with unauthenticated users to collect input, the vulnerable code path is exposed by design in standard deployments.

Remote Code Execution

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the Formie plugin for Craft CMS, which allows for the creation of online forms. The flaw enables unauthenticated attackers to potentially disclose sensitive information, alter application data, or execute code on the server by embedding malicious code within form submissions. This could impact the integrity and confidentiality of data processed by affected websites.

Malicious code in forms can lead to server compromise.
Affects public-facing websites using the Formie plugin.
Confirm relevance to protect site data and operations.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by submitting specially crafted data to a public form. This data, when processed by the vulnerable Formie plugin, can be misinterpreted as executable code within the Twig rendering layer. Successful exploitation can lead to the disclosure of sensitive information, alteration of application state, or even remote code execution.

Public form exposure
User-supplied input in hidden fields
Sensitive data disclosure or code execution

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious code into specific form fields, leading to the server processing this code as executable commands. This can occur when a public form includes a hidden field that processes request data, such as the user agent or current URL, without proper sanitization. Depending on the website's configuration, this could result in the disclosure of sensitive information, alteration of application data, or even complete system compromise.

Sensitive website data.
Via crafted input in public forms.
Information disclosure or system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Formie Craft CMS plugin's ability to render request-derived hidden field defaults to Twig poses a risk. Application owners and infrastructure teams should first identify all instances of the affected plugin, confirm exposure and business criticality, and then coordinate remediation.

Application owners should manage this issue.
Verify public form exposure and reachability.
Plan for controlled version upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Formie plugin for Craft CMS?

Formie is an extension for the Craft CMS platform used to build and manage interactive web forms. Developers use it to collect user data, handle submissions, and integrate forms directly into a website's front-end experience. By design, it streamlines how information is gathered and processed within the Craft CMS ecosystem.

How does CVE-2026-52889 enable server-side template injection?

This vulnerability, classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), occurs when the plugin treats incoming request data as executable code rather than plain text. Because the plugin passes certain hidden field values—like User Agents or URLs—directly to the Twig rendering layer, an attacker can insert Twig syntax into those requests to trick the server into running unintended commands.

Does all user input trigger this Formie vulnerability?

No. The issue is specifically linked to how the plugin handles hidden fields that are configured to pull default values from the request. If a form does not contain these specific hidden fields set to process request-derived defaults, the vulnerable code path is not engaged, meaning typical form inputs are not the primary concern here.

Why is this vulnerability a concern for my website?

Halo Surface Signal indicates this is a high-priority issue because Formie is designed for public-facing forms. Since these forms are intended to accept input from unauthenticated users, the vulnerable path is often exposed by default. If your site uses public forms with these hidden fields, attackers can reach the vulnerable component directly over the internet.

How do I secure my site against this Formie flaw?

The primary step is to update the Formie plugin to version 3.1.27 or later, which includes the necessary fixes to prevent improper template rendering. You should prioritize identifying all Craft CMS instances running older versions of this plugin and coordinate a timely upgrade to ensure that request data is properly sanitized before reaching the Twig engine.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.