PT-2025-9201 · Formwork · Formwork

Published 2025-03-01 · Updated 2025-03-01

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Formwork versions 2.x

Description The site title field at "/panel/options/site" allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users. The attack leverages XSS and can impact system availability. By embedding "<!--", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.

Recommendations For Formwork version 2.x, update to a version that includes the patch that escapes the site title from the panel header navigation, such as the version committed in aa3e9c6. As a temporary workaround, consider restricting access to the site title field to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

GHSA-VF6X-59HH-332F

Affected Products

Formwork

References · 4

• https://osv.dev/vulnerability/GHSA-vf6x-59hh-332f · Vendor Advisory
• https://github.com/getformwork/formwork · Note
• https://github.com/getformwork/formwork/commit/aa3e9c684035d9e8495169fde7c57d97faa3f9a2 · Note
• https://github.com/getformwork/formwork/security/advisories/GHSA-vf6x-59hh-332f · Note