CVE-2025-64515 Open Forms prefill data in read-only components can be tampered

What is CVE-2025-64515?

CVE-2025-64515 is a medium-severity vulnerability in open-formulieren open-forms, published on 18 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3.

Weakness: CWE-20

Which versions are affected by CVE-2025-64515?

It affects 1 product.

Products include Maykinmedia Open Forms.

How do I fix CVE-2025-64515?

No fix has been published for CVE-2025-64515 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-64515 being exploited?

There is no known exploitation of CVE-2025-64515 in the wild and no public exploit code.

Other vulnerabilities in open-formulieren open-forms

• CVE-2024-24771 Open Forms potential multi-factor authentication bypass High 7.7
• CVE-2022-31041 Insufficient content-type validation for uploaded files in open-forms High 7.6
• CVE-2022-31040 Open Redirect in open-forms High 7.1
• CVE-2026-28803 Open Forms possible to view submission details of other people than intended Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cp63-63mq-5wvf.