CVE-2026-52889

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form rendering. An unauthenticated attacker can place Twig syntax in one of these request-controlled inputs when a public form contains an affected Hidden field. Hidden::getFrontEndInputOptions() then assigns the value to defaultValue and calls renderString, causing server-side template evaluation rather than treating the request data as a plain string. Depending on the Craft site configuration and available Twig capabilities, exploitation can disclose sensitive information, modify application state, or achieve remote code execution. This issue is fixed in version 3.1.27.

• CWE-1336

• https://github.com/verbb/formie/commit/d3b9d15290405e484e3b5c91c5d8fab93047f9b2
• https://github.com/verbb/formie/releases/tag/3.1.27
• https://github.com/verbb/formie/security/advisories/GHSA-565m-g33j-jq96

Published

Aug 19, 2026

Last Modified

Sep 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52880Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-52884Notepad++ is a free and open-source source code editor. In v…7.8
• CVE-2026-52885Notepad++ is a free and open-source source code editor. Prio…6.3
• CVE-2026-52886Notepad++ is a free and open-source source code editor. Prio…5.1
• CVE-2026-52887NocoBase is an AI-powered no-code/low-code platform for buil…10
• CVE-2026-52888NocoBase is an AI-powered no-code/low-code platform for buil…6.8
• CVE-2026-5289Use after free in Navigation in Google Chrome prior to 146.0…9.6
• CVE-2026-52890Wekan is open source kanban built with Meteor. Prior to 9.31…7.1
• CVE-2026-52891Wekan is open source kanban built with Meteor. Prior to 9.07…9.9
• CVE-2026-52892Wekan is open source kanban built with Meteor. Prior to 9.32…6.5
• CVE-2026-52893Wekan is open source kanban built with Meteor. Prior to 9.32…9.2
• CVE-2026-5290Use after free in Compositing in Google Chrome prior to 146.…9.6