PT-2025-16117 · Formie · Formie

Engram-Design · Published 2025-04-11 · Updated 2025-09-17 · CVE-2025-32426

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Formie versions prior to 2.1.44

Description: The issue allows malicious code injection into the HTML content of an email notification, which is then rendered on the preview. This requires access to the form's email notification settings. The problem does not occur when rendering the email via normal means, such as a delivered email.

Recommendations: For versions prior to 2.1.44, update to version 2.1.44 to resolve the issue. As a temporary workaround, consider restricting access to the form's email notification settings to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-32426

GHSA-2XM2-23FF-P8WW

Affected Products

Formie

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32426.json · Exploit
• https://github.com/verbb/formie/security/advisories/GHSA-2xm2-23ff-p8ww · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2xm2-23ff-p8ww · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32426 · Security Note
• https://github.com/verbb/formie · Note
• https://t.me/cvedetector/22764 · Telegram Post
• https://t.me/cvetracker/21424 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1910724809798885706 · Twitter Post
• https://t.me/cveNotify/135692 · Telegram Post
• https://twitter.com/CVEnew/status/1910730090474070145 · Twitter Post