Formie is a plugin for Craft CMS that allows the creation of forms. Prior to the 3.1.27 release, the plugin could forward request‑derived defaults for hidden fields—such as the HTTP User Agent, Referer URL, Current URL, query parameters, or cookie values—to Craft’s Twig rendering layer during front‑end rendering. When a public form contains an affected hidden field, Formie assigns the injected value to defaultValue and calls renderString, which evaluates the Twig syntax on the server. This server‑side template injection can lead to disclosure of sensitive information, modification of application state, or—depending on the site’s Twig configuration—remote code execution.

All installations of the Craft CMS plugin Formie from verbb, version 3.1.27 or earlier, are vulnerable. The issue appears when a public form includes a hidden field that uses a request‑derived default value such as the HTTP User Agent, Referer URL, Current URL, Current URL without query string, query parameters, or cookie value.

The CVSS base score of 9.8 indicates critical severity. EPSS score < 1%, indicating a very low probability of exploitation, though the vulnerability requires specific conditions such as a public form containing a vulnerable hidden field, which limits the attack surface. The vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can supply malicious Twig syntax via a request parameter, causing the server to evaluate it. The impact ranges from data disclosure to remote code execution, depending on the Twig capabilities available on the target site.