PT-2025-48034 · Formwork · Formwork

Published 2025-11-24 · Updated 2025-11-26 · CVE-2025-65956

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Formwork versions prior to 2.2.0

Description Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cross-site scripting (XSS). Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker-controlled script executed in their browser. The issue is persistent and impacts privileged administrative workflows. The vulnerable field is the blog tag field, where unsanitized data can be injected.

Recommendations Update to version 2.2.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65956

GHSA-7J46-F57W-76PJ

Affected Products

Formwork

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65956.json · Exploit
• 🔥 https://github.com/getformwork/formwork/security/advisories/GHSA-7j46-f57w-76pj · Exploit
• https://github.com/getformwork/formwork/commit/4abcd60ae7692b46d316f956b0b20fb85336f3b2 · Patch
• https://github.com/getformwork/formwork/pull/791 · Patch
• https://osv.dev/vulnerability/GHSA-7j46-f57w-76pj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65956 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65956 · Vendor Advisory
• https://github.com/getformwork/formwork · Note
• https://twitter.com/CVEnew/status/1993465602497724747 · Twitter Post
• https://t.me/cveNotify/144034 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1p6brge/resumen_diario_de_vulnerabilidades_25112025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1993578525672997010 · Twitter Post