CVE-2024-35191 MEDIUM

CVE-2024-35191: verbb/formie Server-Side Template Injection for variable-enabled settings

Vendor Verbb

Product formie

Weakness CWE-1336

Published May 20, 2024

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

4.4/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This has been fixed in Formie 2.1.6.

Key dates

02Disclosure timeline

May 20, 2024 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-35191 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1336.html

Related vulnerabilities

04Related CVE

CVE-2026-25731 Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export CVE-2026-31864 JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering CVE-2024-58303 FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings CVE-2026-2969 datapizza-labs datapizza-ai Jinja2 Template prompt.py ChatPromptTemplate special elements used in a template engine CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine