CVE-2026-105950 - Vulnerability Details

- getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

Description

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.

Published: 2026-10-06

Score: 5.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A cross‑site scripting flaw exists in the DomSanitizer component of Formwork, allowing an attacker to inject malicious content through the formaction attribute during node sanitization. The vulnerability can be triggered remotely and could lead to session hijacking, data theft or defacement of the web application.

Affected Systems

The issue affects Getformwork Formwork installations up to and including version 2.3.12. The vulnerable code resides in formwork/src/Sanitizer/DomSanitizer.php within the URI Sanitizer module. Version 2.3.13 contains the patch that rectifies the sanitization logic.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit can be launched remotely, the attack vector is likely through a crafted request to a Formwork instance that processes untrusted form actions. The overall risk is considered moderate, requiring timely mitigation to prevent client‑side compromise.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

getformwork

formwork

affected

Version	Status	Constraints
`2.3.0`	affected	—
`2.3.1`	affected	—
`2.3.2`	affected	—
`2.3.3`	affected	—
`2.3.4`	affected	—
`2.3.5`	affected	—
`2.3.6`	affected	—
`2.3.7`	affected	—
`2.3.8`	affected	—
`2.3.9`	affected	—
`2.3.10`	affected	—
`2.3.11`	affected	—
`2.3.12`	affected	—
`2.3.13`	unaffected	—

No data.

Vendor Product Confidence Versions

Getformwork

Formwork

100%

Version	Status	Scheme	Platform
`2.3.0`	affected	semver	—
`2.3.1`	affected	semver	—
`2.3.2`	affected	semver	—
`2.3.3`	affected	semver	—
`2.3.4`	affected	semver	—
`2.3.5`	affected	semver	—
`2.3.6`	affected	semver	—
`2.3.7`	affected	semver	—
`2.3.8`	affected	semver	—
`2.3.9`	affected	semver	—
`2.3.10`	affected	semver	—
`2.3.11`	affected	semver	—
`2.3.12`	affected	semver	—
`2.3.13`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor‑released Formwork 2.3.13 update which replaces the affected DomSanitizer logic.
Deploy the updated version in all production and staging environments to stop the XSS vector.
Implement additional checks or a whitelist for form action values to further limit the possibility of malicious input.

Generated by OpenCVE AI on October 6, 2026 at 18:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00237.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/getformwork/formwork/
https://github.com/getformwork/formwork/commit/729701e59c5886685c5a1d477bdc3035e41f18b1
https://github.com/getformwork/formwork/pull/940
https://github.com/getformwork/formwork/releases/tag/2.3.13
https://github.com/getformwork/formwork/security/advisories/GHSA-p78q-v3pr-p87j
https://vuldb.com/cve/CVE-2026-105950
https://vuldb.com/submit/992820
https://vuldb.com/vuln/413925
https://vuldb.com/vuln/413925/cti

History

Tue, 06 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 06 Oct 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.
Title		getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
First Time appeared		Getformwork Getformwork formwork
Weaknesses		CWE-79 CWE-94
CPEs		cpe:2.3:a:getformwork:formwork::::::::
Vendors & Products		Getformwork Getformwork formwork
References		https://github.com/getformwork/formwork/ https://github.com/getformwork/formwork/commit/729701e59c5886685c5a1d477bdc3035e41f18b1 https://github.com/getformwork/formwork/pull/940 https://github.com/getformwork/formwork/releases/tag/2.3.13 https://github.com/getformwork/formwork/security/advisories/GHSA-p78q-v3pr-p87j https://vuldb.com/cve/CVE-2026-105950 https://vuldb.com/submit/992820 https://vuldb.com/vuln/413925 https://vuldb.com/vuln/413925/cti
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C'}` cvssV3_0 `{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C'}` cvssV3_1 `{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}`

Subscriptions

Getformwork Formwork

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-06T15:30:18.854Z

Updated: 2026-10-06T17:20:55.264Z

Reserved: 2026-10-06T08:04:05.474Z

Link: CVE-2026-105950

Vulnrichment

Updated: 2026-10-06T17:20:50.506Z

NVD

Status : Deferred

Published: 2026-10-06T16:17:06.697

Modified: 2026-10-06T18:16:50.783

Link: CVE-2026-105950

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-07T08:00:11Z

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-94
Improper Control of Generation of Code ('Code Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object