PT-2025-16118 · Craft Cms · Formie
Engram-Design
·
Published
2025-04-11
·
Updated
2025-09-17
·
CVE-2025-32427
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Formie versions prior to 2.1.44
Description:
The issue arises when importing a form from JSON into Formie, a Craft CMS plugin for creating forms. If the field label or handle contains malicious content, the output is not correctly escaped when viewing a preview of what is to be imported. This can lead to a cross-site scripting issue. The vulnerability is considered moderate because it primarily affects users who have exported the form from one environment to another and would require direct manipulation of the JSON export. It is noted that this vulnerability will not occur unless someone deliberately tampers with the export.
Recommendations:
For versions prior to 2.1.44, update to version 2.1.44 to resolve the issue. As a temporary workaround, consider avoiding the import of forms from untrusted JSON sources and ensure that any JSON exports are thoroughly reviewed for malicious content before import. Restrict access to the form import functionality to minimize the risk of exploitation.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Formie