Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
10 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The control panel action formie/sent-notifications/get-resend-modal-content (SentNotificationsController::actionGetResendModalContent) performed only requireAcceptsJson() and loaded a SentNotification by request id without permission or object-level authorization checks. Any authenticated user who could invoke the action could enumerate notification IDs and read full email content — including recipient headers and the complete HTML body containing submitted form data (PII) — without formie-accessSentNotifications or equivalent permission. Sibling actions in the same controller enforced authorization. Patches Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4). Craft 5: canView() is enforced after loading, consistent with actionEdit. Craft 4: formie-viewSentNotifications permission is required. Workarounds Restrict CP access to trusted users only until upgraded. No configuration workaround. - Reported by Jorge González (jorge@jmilla.es)
Recommended action: Upgrade to 3.1.31 or 2.2.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The anonymous front-end action formie/submissions/submit (SubmissionsController::actionSubmit) trusted a client-supplied submissionId when loading an incomplete submission, with no session binding, ownership check, or edit token validation. An unauthenticated attacker could enumerate sequential submission IDs and overwrite or hijack another user's in-progress (multi-page / save-for-later) submission. Tampered data could be persisted and forwarded via notifications and integrations when the submission was completed. Completed submissions were not affected (isIncomplete=true filter). This is an incomplete remediation of GHSA-pgxq-p76c-x9cg, which added edit-token validation to save-submission but not to submit. Patches Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4). When resuming an existing submission on a site request, the submission ID must match the session-bound submission (Form::getCurrentSubmission()) or a valid submissionEditToken when editingSubmission is set.…
Recommended action: Upgrade to 3.1.31 or 2.2.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The control panel action formie/integrations/form-settings (IntegrationsController::actionFormSettings) was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via setAttributes($settings, false), allowing an attacker to overwrite outbound host properties (e.g. apiUrl) while the server sent stored API keys or OAuth tokens to the attacker-controlled host. The remote response was returned in the JSON body (non-blind SSRF). This is an incomplete remediation of GHSA-cvpc-hccg-wmw4. The form-settings action was excluded from the permission gate added in 3.1.28. Any site where a low-privileged user can authenticate (including front-end members on sites with public registration) could exfiltrate CRM/email-marketing/webhook integration credentials and probe internal network endpoints. Patches Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4). The action now requires a CP…
Recommended action: Upgrade to 3.1.31 or 2.2.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Craft CMS control panel user with limited Formie access could directly access Formie settings pages and modify global plugin configuration. In affected versions, Formie settings-related control panel routes did not consistently enforce the required settings permission on the server side. A low-privileged Craft CMS control panel user with limited Formie access could access /admin/formie/settings, save changes to global plugin settings, and access /admin/formie/settings/import-export. The issue has been fixed by enforcing the formie-accessSettings permission across Formie settings controllers and related settings actions. Impact An authenticated low-privileged CP user may be able to: - Access Formie administrative settings. - Modify global Formie plugin configuration. - Access Formie import/export settings functionality. This may allow configuration tampering and…
Recommended action: Upgrade to 3.1.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Formie Hidden fields could evaluate request-derived values as Twig during front-end form rendering. When a Hidden field used a dynamic default value such as HTTP User Agent, Referer URL, Current URL, Query Parameter, or Cookie Value, the value was copied from the incoming request and later passed to Craft’s Twig rendering layer. This allowed an unauthenticated attacker to provide Twig syntax in request-controlled input and have it evaluated server-side when the form was rendered. Affected Versions verbb/formie for Craft 5: - Affected: = 3.0.0-beta.1, <= 3.1.26 - Patched: 3.1.27 Impact An unauthenticated attacker could trigger server-side template evaluation by visiting a public form containing a Hidden field configured with a request-derived default value. Because Craft’s normal Twig environment exposes application objects, this may lead to disclosure of sensitive information, modification of application state, or remote code execution depending on the site configuration and…
Recommended action: Upgrade to 3.1.27 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. Patches 2.2.21, 3.1.26 Workarounds Block unauthenticated access to actions/formie/submissions/save-submission, or disable/customize front-end submission editing until patched. Credit formie extends many thanks to: - Florian (Cyber Security Engineer, arcade solutions ag) - Contact: security@arcade.ch
Recommended action: Upgrade to 3.1.26 or 2.2.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact - Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). - Sites with public Formie forms that include at least one Hidden field with that configuration. - No CP login for the reported chain. Patches - 2.2.20, 3.1.24 Workarounds - Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible - Otherwise, upgrade to patched versions
Recommended action: Upgrade to 3.1.24 or 2.2.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered email). This would require access to the form's email notification settings. Patches This has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.
Recommended action: Upgrade to 2.1.44 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export. Patches This has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.
Recommended action: Upgrade to 2.1.44 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This is listed as low-medium severity due to requiring control panel access to edit a form's settings. Patches This has been fixed in Formie 2.1.6. Users should ensure they are running at least this version.
Recommended action: Upgrade to 2.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.