Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts. Unauthenticated users could submit Twig expressions through public Freeform forms and have those expressions evaluated when the submitted values were rendered back into the form response. Confirmed impact includes disclosure of limited server/environment information, such as the PHP version and absolute filesystem paths. No evidence was found that this issue allowed access to Craft globals, environment variables, database credentials, mailer credentials, security keys, or remote code execution in the tested environment. Details Plugin: Solspace Freeform Affected versions: Freeform 5.0.0 through 5.10.13 CMS: Craft CMS Authentication required: None Attack vector: Public Freeform form submission Submitted field values were passed through Freeform’s isolated Twig renderer.…
Recommended action: Upgrade to 5.10.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens. Affected Product - Ecosystem: Packagist (Craft CMS plugin) - Package: solspace/craft-freeform - Version: <= 5.14.6 (latest observed). Likely all 5.x until patched. Details - Root cause: Multiple user-controlled strings (field labels, section labels, integration icons, short names, WYSIWYG previews) are injected into React components using dangerouslySetInnerHTML without sanitization. - Evidence: dangerouslySetInnerHTML on user-controlled properties in bundled CP JS at packages/plugin/src/Resources/js/client/client.js. PoCs - Label-based XSS: 1. In Craft CP, create/edit a Freeform field and set its label to <img…
Recommended action: Upgrade to 5.14.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The latest versions of both 4.x and 5.x are using Axios versions < 1.7.5 and as such are subject to known vulnerabilities as per: https://security.snyk.io/package/npm/axios Details We've had this flagged up in a pen test, which indicates the issue stems from this script: /freeform/plugin.js. I couldn't see any reference to vulnerable axios versions in your package.json files, but noticed some precompiled files in packages/plugin so I'm assuming those are where the issue lies.
Recommended action: Upgrade to 5.5.9 or 4.1.22 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. \PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. See https://github.com/advisories/GHSA-wgmf-q9vr-vww6 PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Example target script: Save this file in the same directory: book.xlsx Open index.php in a web browser. An alert should be displayed. Impact What kind of vulnerability is it? Who is impacted? Full takeover of the session of users viewing spreadsheet files as HTML.
Recommended action: Upgrade to 4.1.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).
Recommended action: Upgrade to 5.10.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.