CVE-2026-73858: Server-Side Twig Template Injection in Solspace Freeform for Craft CMS
Vulnerability ID: CVE-2026-73858
CVSS Score: 5.3
Published: 2026-09-23
A technical analysis of CVE-2026-73858 / GHSA-gxrg-x694-283w, a server-side template injection vulnerability in the Solspace Freeform plugin for Craft CMS. The vulnerability permits unauthenticated users to trigger dynamic Twig evaluation of input fields during form validation re-rendering, causing local directory path disclosure and PHP runtime information exposure.
TL;DR
Unauthenticated remote attackers can inject Twig expressions into form inputs in Solspace Freeform versions 5.x < 5.10.14. When validation fails and the form re-renders, the input values are processed by an isolated Twig instance, allowing system configuration and path disclosure.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-1336
- Attack Vector: Network (AV:N)
- CVSS Score: 5.3 (Medium)
- Exploit Status: Proof-of-Concept (PoC)
- CISA KEV Status: Not Listed
- Impact: Information Disclosure / Local Path Leakage
Affected Systems
- Solspace Freeform 5.x instances running on Craft CMS 5.x
-
Solspace Freeform: >= 5.0.0, < 5.10.14 (Fixed in:
5.10.14)
Code Analysis
Commit: 5f75553
Excludes vulnerable fields (value, name, id) from Twig rendering to prevent Server-Side Template Injection.
Mitigation Strategies
- Upgrade Freeform plugin to 5.10.14 or later.
- Deploy Web Application Firewall (WAF) rules to filter Twig dynamic symbols.
- Perform regular dependency audits on Craft CMS plugins.
Remediation Steps:
- Navigate to the Craft CMS root directory.
- Execute 'composer update solspace/craft-freeform' via terminal.
- Run 'php craft migrate/all' to apply any associated database structural migrations.
- Clear application caches using 'php craft clear-caches/all'.
References
Read the full report for CVE-2026-73858 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)