Solspace Freeform plugin for Craft CMS 5.x processes submitted field values through an isolated Twig renderer when rendering into HTML attributes. This input validation flaw, identified as CWE‑1336, allows an attacker to embed Twig expressions in those values, causing the renderer to expose PHP, operating‑system, or Craft filesystem constants in the form response. The isolation limits disclosure to non‑global information and does not allow arbitrary code execution, so the impact is confined to server and environment details and potential rendering errors.

The vulnerability impacts Solspace Freeform plugin versions 5.0.0 through 5.10.13 on Craft CMS 5.x. Any site using these releases should verify the installed plugin version and update if necessary.

The CVSS score of 5.3 indicates moderate severity. An unauthenticated attacker can exploit the flaw by submitting data to a publicly accessible form, which is typically reachable over the Internet. While disclosure is limited, the ease of exploitation and the potential to gather server information increase the risk, especially for sites with widely exposed freeform pages.