Description
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-01
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery
Action: Assess Impact
AI Analysis

Impact

The Form Tools application contains an AJAX endpoint that accepts a URL parameter through its smart_fill routine. An attacker can manipulate this parameter so that the server retrieves arbitrary URLs, enabling server‑side request forgery (SSRF). This flaw is classified as CWE‑918. By exploiting it, a remote adversary can cause the server to access internal resources, probe the internal network, or exfiltrate data, thereby compromising confidentiality and integrity of the host system.

Affected Systems

Form tools.org Form Tools versions up to 3.1.1, specifically the smart_fill function in /global/code/actions.php of the AJAX Endpoint component, are affected. No other versions or modules are listed as impacted.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. An exploit has been published and can be triggered remotely without authentication, making the attack surface large. Because the vendor has not yet released a fix, the risk remains elevated until a patch or mitigation is applied.

Generated by OpenCVE AI on October 1, 2026 at 07:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Disable or harden the smart_fill endpoint to reject external URLs and prevent outbound fetching
  • Restrict access to the AJAX endpoint to trusted IP addresses or internal networks
  • Monitor outbound traffic and server logs for unexpected requests originating from the endpoint
  • Apply an official vendor patch or update to a fixed version as soon as it becomes available

Generated by OpenCVE AI on October 1, 2026 at 07:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Formtools
Formtools form Tools
Vendors & Products Formtools
Formtools form Tools

Thu, 01 Oct 2026 06:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery
First Time appeared Form Tools
Form Tools form Tools
Weaknesses CWE-918
CPEs cpe:2.3:a:form_tools:form_tools:*:*:*:*:*:*:*:*
Vendors & Products Form Tools
Form Tools form Tools
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Form Tools Form Tools
Formtools Form Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-06T00:02:30.830Z

Reserved: 2026-09-30T19:07:46.908Z

Link: CVE-2026-103542

cve-icon Vulnrichment

Updated: 2026-10-06T00:02:27.187Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T06:17:06.417

Modified: 2026-10-06T01:16:33.680

Link: CVE-2026-103542

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T15:30:08Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)