solspace/craft-freeform

The most flexible and user-friendly form building plugin for Craft CMS!

View on Packagist

View on Github

Activity

Latest release: 1w ago
Total releases: 564
Cadence: ~4 days
Last 12 months: 75

Reach

Stars: 54

Details

First release: Jan 24, 2018

Releases

Version	Released
`5.15.29` patch	Sep 07, 2026
`5.15.28` patch	Aug 31, 2026
`5.15.27` patch	Aug 21, 2026
`4.1.32` patch	Aug 13, 2026
`5.15.26` patch	Aug 13, 2026
`5.15.25` patch	Aug 12, 2026
`5.15.24` patch	Aug 11, 2026
`5.15.23` patch	Aug 06, 2026
`6.0.0-beta.4` pre	Jul 27, 2026
`5.15.22` patch	Jul 27, 2026
`5.15.21` patch	Jul 13, 2026
`6.0.0-beta.3` pre	Jul 13, 2026
`5.15.20` patch	Jul 08, 2026
`5.15.19` patch	Jul 02, 2026
`5.15.18` patch	Jun 25, 2026
`5.15.17` patch	Jun 19, 2026
`6.0.0-beta.2` pre	Jun 16, 2026
`5.15.16` patch	Jun 16, 2026
`6.0.0-beta.1` pre	Jun 08, 2026
`5.15.15` patch	Jun 06, 2026
`5.15.14` patch	May 29, 2026
`5.15.13` patch	May 18, 2026
`5.15.12` patch	May 15, 2026
`5.15.11` patch	May 13, 2026
`5.15.10` patch	May 11, 2026
`5.15.9` patch	May 05, 2026
`5.15.8` patch	Apr 29, 2026
`5.15.7` patch	Apr 23, 2026
`5.15.6.1` patch	Apr 17, 2026
`5.15.6` patch	Apr 16, 2026
`5.15.5` patch	Apr 09, 2026
`5.15.4` patch	Apr 08, 2026
`5.15.3` patch	Apr 01, 2026
`5.15.2` patch	Mar 31, 2026
`5.15.1` patch	Mar 30, 2026
`5.15.0` minor	Mar 30, 2026
`5.14.24` patch	Mar 25, 2026
`5.14.23` patch	Mar 17, 2026
`5.14.22` patch	Mar 16, 2026
`5.14.21` patch	Mar 12, 2026
`5.14.20` patch	Mar 04, 2026
`5.14.19` patch	Mar 02, 2026
`5.14.18` patch	Feb 26, 2026
`5.14.17` patch	Feb 25, 2026
`5.14.16` patch	Feb 19, 2026
`5.14.15` patch	Feb 12, 2026
`5.14.14` patch	Feb 11, 2026
`5.14.13` patch	Feb 10, 2026
`5.14.12` patch	Feb 08, 2026
`5.14.11` patch	Feb 05, 2026

1–50 of 564

Repository

solspace/craft-freeform

Forks: 61
Open issues: 0
Language: PHP

craft-plugin
craftcms
craftcms5

Dependencies (17)

Depends on

5.15.29

Used by

Supply-chain exposure

12 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (5)

CVE-2026-26188 GHSA-jp3q-wwp3-pwv9 Jan 22, 2026

Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue

Low
Network Low None

Summary An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens.

Affected Product

Ecosystem: Packagist (Craft CMS plugin)

Package: solspace/craft-freeform

Version: <= 5.14.6 (latest observed). Likely all 5.x until patched.

Details

Root cause: Multiple user-controlled strings (field labels, section labels, integration icons, short names, WYSIWYG previews) are injected into React components using dangerouslySetInnerHTML without sanitization.

Evidence: dangerouslySetInnerHTML on user-controlled properties in bundled CP JS at packages/plugin/src/Resources/js/client/client.js.

PoCs

Label-based XSS:

In Craft CP, create/edit a Freeform field and set its label to <img src=x onerror="alert('xss-label')">.

Open the form builder view containing the field.

Alert executes (stored XSS).

Integration icon SVG:

Set an integration "icon SVG" to <svg><script>alert('xss-icon')</script></svg>.

Open the integrations CP view.

Script executes.

Impact Arbitrary JS in admin CP; session/CSRF token theft; potential full admin takeover via DOM-driven actions.

Remediation

Sanitize/HTML-encode all user-controlled strings before passing to dangerouslySetInnerHTML, or avoid it for labels/titles/icons.

Server-side: strip/escape disallowed tags on save for fields, integration metadata, WYSIWYG content.

Add regression tests with <img onerror> payloads to ensure no execution in builder/integration views.

Workarounds

Restrict form-edit permissions to trusted admins only until patched.

Consider CSP that disallows inline scripts (defense-in-depth only).

Credits

Discovered by https://www.linkedin.com/in/praveenkavinda/ | Prav33N-Sec.

Affected versions

5.0.05.0.15.0.105.0.115.0.125.0.135.0.145.0.14.15.0.155.0.165.0.25.0.3

+ 158 more Show less

5.0.45.0.55.0.65.0.6.15.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.13.15.1.145.1.155.1.165.1.16.15.1.175.1.185.1.18.15.1.195.1.19.15.1.25.1.35.1.45.1.55.1.5.15.1.65.1.75.1.85.1.95.10.05.10.15.10.105.10.115.10.125.10.135.10.145.10.155.10.15.15.10.165.10.16.15.10.175.10.17.15.10.25.10.35.10.45.10.55.10.65.10.75.10.85.10.95.11.05.11.15.11.105.11.115.11.125.11.135.11.145.11.165.11.175.11.25.11.35.11.45.11.55.11.65.11.75.11.85.11.95.12.05.12.15.12.25.12.35.12.45.13.05.13.15.13.25.13.35.13.45.13.55.13.65.13.75.13.85.14.05.14.15.14.25.14.35.14.45.14.55.14.65.2.05.2.15.2.25.3.05.3.15.3.25.3.35.3.3.15.3.45.3.55.4.05.4.15.4.25.5.05.5.15.5.105.5.25.5.35.5.45.5.55.5.65.5.75.5.85.5.95.6.05.6.15.6.25.6.35.6.45.6.55.6.65.6.75.6.85.7.05.7.0.15.7.15.7.25.7.35.7.45.8.05.8.15.8.25.8.35.8.45.8.55.8.65.8.75.9.05.9.15.9.1.15.9.1.25.9.105.9.115.9.125.9.135.9.145.9.155.9.165.9.16.15.9.25.9.35.9.45.9.55.9.65.9.75.9.85.9.9

Fixed in

5.14.7

References

https://github.com/solspace/craft-freeform/security/advisories/GHSA-jp3q-wwp3-pwv9
https://nvd.nist.gov/vuln/detail/CVE-2026-26188
https://github.com/solspace/craft-freeform/commit/b9adad6cdf1eba5400aae8b1ae39bd7d4d33af5e
https://github.com/solspace/craft-freeform
https://github.com/solspace/craft-freeform/releases/tag/v5.14.7

Updated Feb 13, 2026 · Source: OSV.dev
GHSA-rwr8-xrpw-9qf5 Jan 15, 2026

solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets

Low

Summary

The latest versions of both 4.x and 5.x are using Axios versions < 1.7.5 and as such are subject to known vulnerabilities as per: https://security.snyk.io/package/npm/axios

Details

We've had this flagged up in a pen test, which indicates the issue stems from this script: /freeform/plugin.js. I couldn't see any reference to vulnerable axios versions in your package.json files, but noticed some precompiled files in packages/plugin so I'm assuming those are where the issue lies.

Affected versions

2.0.02.0.0-beta.12.0.0-beta.102.0.0-beta.112.0.0-beta.122.0.0-beta.132.0.0-beta.142.0.0-beta.152.0.0-beta.162.0.0-beta.172.0.0-beta.182.0.0-beta.19

+ 384 more Show less

2.0.0-beta.22.0.0-beta.202.0.0-beta.32.0.0-beta.42.0.0-beta.52.0.0-beta.62.0.0-beta.72.0.0-beta.82.0.0-beta.92.0.12.0.22.0.32.0.42.1.02.1.12.2.02.2.12.2.22.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.5.02.5.12.5.102.5.112.5.122.5.132.5.142.5.152.5.162.5.172.5.182.5.192.5.22.5.202.5.212.5.222.5.232.5.242.5.252.5.262.5.272.5.32.5.42.5.52.5.62.5.72.5.82.5.93.0.03.0.0-beta.13.0.13.0.23.0.33.0.43.0.53.0.63.1.03.10.03.10.0-beta.13.10.0-beta.23.10.0-beta.33.10.0-beta.43.10.0-beta.53.10.0-beta.63.10.13.10.103.10.113.10.23.10.2.13.10.33.10.43.10.53.10.63.10.73.10.83.10.93.11.03.11.0-beta.13.11.0-beta.23.11.0-beta.33.11.0-beta.43.11.0-beta.53.11.0-beta.63.11.13.11.103.11.113.11.11.13.11.123.11.133.11.13.13.11.23.11.33.11.43.11.4.13.11.53.11.63.11.73.11.83.11.93.12.03.12.0-beta.103.12.0-beta.33.12.0-beta.43.12.0-beta.53.12.0-beta.63.12.0-beta.73.12.0-beta.83.12.0-beta.93.12.13.12.103.12.113.12.123.12.12.13.12.133.12.23.12.33.12.43.12.53.12.63.12.73.12.83.12.93.12.9.13.13.03.13.13.13.103.13.113.13.123.13.133.13.143.13.153.13.163.13.173.13.183.13.193.13.23.13.203.13.213.13.223.13.22.13.13.233.13.243.13.253.13.263.13.273.13.283.13.293.13.33.13.303.13.313.13.323.13.333.13.343.13.353.13.363.13.373.13.383.13.43.13.53.13.5.13.13.63.13.73.13.83.13.93.2.03.2.13.2.23.2.33.2.43.2.53.3.03.3.13.3.23.3.33.4.03.4.13.5.03.5.13.5.103.5.23.5.33.5.43.5.53.5.63.5.73.5.83.5.93.6.03.6.13.6.103.6.113.6.123.6.23.6.33.6.43.6.53.6.63.6.73.6.83.6.93.7.03.7.13.7.23.7.33.7.43.7.53.8.03.8.13.8.23.8.33.8.43.9.03.9.13.9.103.9.113.9.23.9.33.9.43.9.53.9.63.9.73.9.83.9.94.0.04.0.0-beta.14.0.0-beta.104.0.0-beta.114.0.0-beta.124.0.0-beta.134.0.0-beta.144.0.0-beta.154.0.0-beta.15.14.0.0-beta.164.0.0-beta.174.0.0-beta.184.0.0-beta.24.0.0-beta.34.0.0-beta.44.0.0-beta.54.0.0-beta.64.0.0-beta.74.0.0-beta.84.0.0-beta.94.0.14.0.104.0.114.0.124.0.134.0.144.0.154.0.164.0.174.0.184.0.194.0.24.0.204.0.214.0.224.0.234.0.244.0.24.14.0.254.0.264.0.34.0.44.0.54.0.64.0.74.0.84.0.94.1.04.1.14.1.104.1.114.1.124.1.12.14.1.134.1.144.1.154.1.15.14.1.164.1.174.1.184.1.194.1.24.1.204.1.214.1.34.1.44.1.54.1.64.1.74.1.84.1.95.0.05.0.0-beta.15.0.0-beta.105.0.0-beta.115.0.0-beta.125.0.0-beta.135.0.0-beta.145.0.0-beta.155.0.0-beta.165.0.0-beta.175.0.0-beta.25.0.0-beta.35.0.0-beta.45.0.0-beta.55.0.0-beta.65.0.0-beta.75.0.0-beta.85.0.0-beta.95.0.15.0.105.0.115.0.125.0.135.0.145.0.14.15.0.155.0.165.0.25.0.35.0.45.0.55.0.65.0.6.15.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.13.15.1.145.1.155.1.165.1.16.15.1.175.1.185.1.18.15.1.195.1.19.15.1.25.1.35.1.45.1.55.1.5.15.1.65.1.75.1.85.1.95.2.05.2.15.2.25.3.05.3.15.3.25.3.35.3.3.15.3.45.3.55.4.05.4.15.4.25.5.05.5.15.5.25.5.35.5.45.5.55.5.65.5.75.5.8

Fixed in

4.1.225.5.9

References

https://github.com/solspace/craft-freeform/security/advisories/GHSA-rwr8-xrpw-9qf5
https://github.com/solspace/craft-freeform

Updated Feb 03, 2026 · Source: OSV.dev
GHSA-44jg-mv3h-wj6g Jan 15, 2026

solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data

Low
Network Low Low

Summary

Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.

\PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.

Details

Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.

See https://github.com/advisories/GHSA-wgmf-q9vr-vww6

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Example target script:

<?php require 'vendor/autoload.php'; $reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx"); $spreadsheet = $reader->load(__DIR__ . '/book.xlsx'); $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet); print($writer->generateHTMLAll());

Save this file in the same directory:

book.xlsx

Open index.php in a web browser. An alert should be displayed.

Impact

What kind of vulnerability is it? Who is impacted?

Full takeover of the session of users viewing spreadsheet files as HTML.

Affected versions

2.0.02.0.0-beta.12.0.0-beta.102.0.0-beta.112.0.0-beta.122.0.0-beta.132.0.0-beta.142.0.0-beta.152.0.0-beta.162.0.0-beta.172.0.0-beta.182.0.0-beta.19

+ 302 more Show less

2.0.0-beta.22.0.0-beta.202.0.0-beta.32.0.0-beta.42.0.0-beta.52.0.0-beta.62.0.0-beta.72.0.0-beta.82.0.0-beta.92.0.12.0.22.0.32.0.42.1.02.1.12.2.02.2.12.2.22.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.5.02.5.12.5.102.5.112.5.122.5.132.5.142.5.152.5.162.5.172.5.182.5.192.5.22.5.202.5.212.5.222.5.232.5.242.5.252.5.262.5.272.5.32.5.42.5.52.5.62.5.72.5.82.5.93.0.03.0.0-beta.13.0.13.0.23.0.33.0.43.0.53.0.63.1.03.10.03.10.0-beta.13.10.0-beta.23.10.0-beta.33.10.0-beta.43.10.0-beta.53.10.0-beta.63.10.13.10.103.10.113.10.23.10.2.13.10.33.10.43.10.53.10.63.10.73.10.83.10.93.11.03.11.0-beta.13.11.0-beta.23.11.0-beta.33.11.0-beta.43.11.0-beta.53.11.0-beta.63.11.13.11.103.11.113.11.11.13.11.123.11.133.11.13.13.11.23.11.33.11.43.11.4.13.11.53.11.63.11.73.11.83.11.93.12.03.12.0-beta.103.12.0-beta.33.12.0-beta.43.12.0-beta.53.12.0-beta.63.12.0-beta.73.12.0-beta.83.12.0-beta.93.12.13.12.103.12.113.12.123.12.12.13.12.133.12.23.12.33.12.43.12.53.12.63.12.73.12.83.12.93.12.9.13.13.03.13.13.13.103.13.113.13.123.13.133.13.143.13.153.13.163.13.173.13.183.13.193.13.23.13.203.13.213.13.223.13.22.13.13.233.13.243.13.253.13.263.13.273.13.283.13.293.13.33.13.303.13.313.13.323.13.333.13.343.13.353.13.363.13.373.13.383.13.43.13.53.13.5.13.13.63.13.73.13.83.13.93.2.03.2.13.2.23.2.33.2.43.2.53.3.03.3.13.3.23.3.33.4.03.4.13.5.03.5.13.5.103.5.23.5.33.5.43.5.53.5.63.5.73.5.83.5.93.6.03.6.13.6.103.6.113.6.123.6.23.6.33.6.43.6.53.6.63.6.73.6.83.6.93.7.03.7.13.7.23.7.33.7.43.7.53.8.03.8.13.8.23.8.33.8.43.9.03.9.13.9.103.9.113.9.23.9.33.9.43.9.53.9.63.9.73.9.83.9.94.0.04.0.0-beta.14.0.0-beta.104.0.0-beta.114.0.0-beta.124.0.0-beta.134.0.0-beta.144.0.0-beta.154.0.0-beta.15.14.0.0-beta.164.0.0-beta.174.0.0-beta.184.0.0-beta.24.0.0-beta.34.0.0-beta.44.0.0-beta.54.0.0-beta.64.0.0-beta.74.0.0-beta.84.0.0-beta.94.0.14.0.104.0.114.0.124.0.134.0.144.0.154.0.164.0.174.0.184.0.194.0.24.0.204.0.214.0.224.0.234.0.244.0.24.14.0.254.0.264.0.34.0.44.0.54.0.64.0.74.0.84.0.94.1.04.1.14.1.104.1.114.1.124.1.12.14.1.134.1.144.1.154.1.15.14.1.164.1.174.1.184.1.194.1.24.1.204.1.214.1.224.1.34.1.44.1.54.1.64.1.74.1.84.1.9

Fixed in

4.1.23

References

https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6
https://github.com/solspace/craft-freeform/security/advisories/GHSA-44jg-mv3h-wj6g
https://github.com/solspace/craft-freeform
https://github.com/solspace/craft-freeform/releases/tag/v4.1.23

Updated Feb 03, 2026 · Source: OSV.dev
GHSA-58q2-9x27-h2jm Jan 15, 2026

solspace/craft-freeform Has a DoS Vulnerability

Low
Network Low None None

Summary

Freeform plugin v4.1.29 uses vulnerable Axios ^1.7.7 allowing unauthenticated attackers to crash servers via malicious data: URIs causing memory exhaustion (CVE-2025-58754).

Freeform version: 4.1.29 Craft CMS version: 4.16.8

Impact

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response. This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.

https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj https://github.com/axios/axios/pull/7011 https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593 https://github.com/axios/axios/releases/tag/v1.12.0

Affected versions

2.0.02.0.0-beta.12.0.0-beta.102.0.0-beta.112.0.0-beta.122.0.0-beta.132.0.0-beta.142.0.0-beta.152.0.0-beta.162.0.0-beta.172.0.0-beta.182.0.0-beta.19

+ 309 more Show less

2.0.0-beta.22.0.0-beta.202.0.0-beta.32.0.0-beta.42.0.0-beta.52.0.0-beta.62.0.0-beta.72.0.0-beta.82.0.0-beta.92.0.12.0.22.0.32.0.42.1.02.1.12.2.02.2.12.2.22.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.5.02.5.12.5.102.5.112.5.122.5.132.5.142.5.152.5.162.5.172.5.182.5.192.5.22.5.202.5.212.5.222.5.232.5.242.5.252.5.262.5.272.5.32.5.42.5.52.5.62.5.72.5.82.5.93.0.03.0.0-beta.13.0.13.0.23.0.33.0.43.0.53.0.63.1.03.10.03.10.0-beta.13.10.0-beta.23.10.0-beta.33.10.0-beta.43.10.0-beta.53.10.0-beta.63.10.13.10.103.10.113.10.23.10.2.13.10.33.10.43.10.53.10.63.10.73.10.83.10.93.11.03.11.0-beta.13.11.0-beta.23.11.0-beta.33.11.0-beta.43.11.0-beta.53.11.0-beta.63.11.13.11.103.11.113.11.11.13.11.123.11.133.11.13.13.11.23.11.33.11.43.11.4.13.11.53.11.63.11.73.11.83.11.93.12.03.12.0-beta.103.12.0-beta.33.12.0-beta.43.12.0-beta.53.12.0-beta.63.12.0-beta.73.12.0-beta.83.12.0-beta.93.12.13.12.103.12.113.12.123.12.12.13.12.133.12.23.12.33.12.43.12.53.12.63.12.73.12.83.12.93.12.9.13.13.03.13.13.13.103.13.113.13.123.13.133.13.143.13.153.13.163.13.173.13.183.13.193.13.23.13.203.13.213.13.223.13.22.13.13.233.13.243.13.253.13.263.13.273.13.283.13.293.13.33.13.303.13.313.13.323.13.333.13.343.13.353.13.363.13.373.13.383.13.43.13.53.13.5.13.13.63.13.73.13.83.13.93.2.03.2.13.2.23.2.33.2.43.2.53.3.03.3.13.3.23.3.33.4.03.4.13.5.03.5.13.5.103.5.23.5.33.5.43.5.53.5.63.5.73.5.83.5.93.6.03.6.13.6.103.6.113.6.123.6.23.6.33.6.43.6.53.6.63.6.73.6.83.6.93.7.03.7.13.7.23.7.33.7.43.7.53.8.03.8.13.8.23.8.33.8.43.9.03.9.13.9.103.9.113.9.23.9.33.9.43.9.53.9.63.9.73.9.83.9.94.0.04.0.0-beta.14.0.0-beta.104.0.0-beta.114.0.0-beta.124.0.0-beta.134.0.0-beta.144.0.0-beta.154.0.0-beta.15.14.0.0-beta.164.0.0-beta.174.0.0-beta.184.0.0-beta.24.0.0-beta.34.0.0-beta.44.0.0-beta.54.0.0-beta.64.0.0-beta.74.0.0-beta.84.0.0-beta.94.0.14.0.104.0.114.0.124.0.134.0.144.0.154.0.164.0.174.0.184.0.194.0.24.0.204.0.214.0.224.0.234.0.244.0.24.14.0.254.0.264.0.34.0.44.0.54.0.64.0.74.0.84.0.94.1.04.1.14.1.104.1.114.1.124.1.12.14.1.134.1.144.1.154.1.15.14.1.164.1.174.1.184.1.194.1.24.1.204.1.214.1.224.1.234.1.244.1.254.1.264.1.274.1.284.1.294.1.34.1.44.1.54.1.64.1.74.1.84.1.9

Fixed in

4.1.30

References

https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj
https://github.com/solspace/craft-freeform/security/advisories/GHSA-58q2-9x27-h2jm
https://github.com/axios/axios/pull/7011
https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593
https://github.com/solspace/craft-freeform/commit/e7402a1d1ce9f28ecb6ce659885ac66391d3a040
https://github.com/axios/axios/releases/tag/v1.12.0

Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-52122 GHSA-9hp3-f5g8-rccg Aug 27, 2025

The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability

9.8 / 10
Critical
Network Low None None Unchanged High High High

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).

Affected versions

5.0.05.0.15.0.105.0.115.0.125.0.135.0.145.0.14.15.0.155.0.165.0.25.0.3

+ 116 more Show less

5.0.45.0.55.0.65.0.6.15.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.13.15.1.145.1.155.1.165.1.16.15.1.175.1.185.1.18.15.1.195.1.19.15.1.25.1.35.1.45.1.55.1.5.15.1.65.1.75.1.85.1.95.10.05.10.15.10.105.10.115.10.125.10.135.10.145.10.155.10.15.15.10.25.10.35.10.45.10.55.10.65.10.75.10.85.10.95.2.05.2.15.2.25.3.05.3.15.3.25.3.35.3.3.15.3.45.3.55.4.05.4.15.4.25.5.05.5.15.5.105.5.25.5.35.5.45.5.55.5.65.5.75.5.85.5.95.6.05.6.15.6.25.6.35.6.45.6.55.6.65.6.75.6.85.7.05.7.0.15.7.15.7.25.7.35.7.45.8.05.8.15.8.25.8.35.8.45.8.55.8.65.8.75.9.05.9.15.9.1.15.9.1.25.9.105.9.115.9.125.9.135.9.145.9.155.9.165.9.16.15.9.25.9.35.9.45.9.55.9.65.9.75.9.85.9.9

Fixed in

5.10.16

References

https://nvd.nist.gov/vuln/detail/CVE-2025-52122
https://github.com/TimTrademark/CVE-2025-52122
https://github.com/TimTrademark/CVE-CraftCMS-Freeform
https://github.com/solspace/craft-freeform

Updated Aug 27, 2025 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 3
minor 34
patch 445
pre 81

564 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More