CVE-2026-52889 Formie: Server-Side Template Injection in Formie Hidden field defaults
Unauthenticated attackers can achieve remote code execution or data disclosure by injecting Twig syntax into Hidden field defaults in Formie.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52889?
CVE-2026-52889 is a critical code injection vulnerability in verbb formie, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form rendering. An unauthenticated attacker can place Twig syntax in one of these request-controlled inputs when a public form contains an affected Hidden field. Hidden::getFrontEndInputOptions() then assigns the value to defaultValue and calls renderString, causing server-side template evaluation rather than treating the request data as a plain string. Depending on the Craft site configuration and available Twig capabilities, exploitation can disclose sensitive information, modify application state, or achieve remote code execution. This issue is fixed in version 3.1.27.
Weakness: CWE-1336
Which versions are affected by CVE-2026-52889?
2 open source packages ship an affected version, including verbb/formie.
| Package | Affected | Fixed in |
|---|---|---|
verbb/formie Packagist | All versions | 3.1.27 |
verbb/formie Packagist | All versions | 3.1.27 |
How do I fix CVE-2026-52889?
Upgrade verbb/formie to 3.1.27 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-52889 being exploited?
There is no known exploitation of CVE-2026-52889 in the wild and no public exploit code.
Sources
Also known as GHSA-565m-g33j-jq96.