Formie, a Craft CMS form plugin, can transmit request‑derived default values for hidden fields directly into Twig’s renderString function. This causes any inserted Twig syntax in those inputs to be executed on the server. The flaw can expose sensitive data, alter application state, or even allow remote code execution, depending on the site’s configuration and available Twig functions. The vulnerability is classified as CWE‑1336.

All installations of the Craft CMS plugin Formie from verbb, version 3.1.27 and earlier, are affected. The issue arises when public forms include hidden fields that use defaults derived from the HTTP User Agent, Referer URL, Current URL, Query Parameters, or Cookie values.

The CVSS base score is 9.8, indicating critical severity. EPSS is not available, so the exploitation probability is unknown but the flaw cannot be exploited without knowledge of the target form layout, making it less likely to be hit broadly. KEV does not list this vulnerability, but the impact remains significant. An unauthenticated attacker can craft a malicious request to a public form that uses an affected hidden field, leading the server to evaluate the injected Twig payload. Successful exploitation depends on the site’s Twig capabilities and could result in disclosure, modification, or arbitrary code execution.