CVE-2026-82451 getformwork CVE debrief

Who should care

Defenders and administrators of Formwork installations should assess exposure and apply patches or workarounds to prevent exploitation. This includes verifying Formwork version, reviewing visit tracking configuration and Referer header handling, and monitoring for suspicious activity on the Statistics panel. Security teams and vulnerability management teams should also review the vulnerability details and assess the potential impact on their systems.

Why it matters

CVE-2026-82451 is a stored cross-site scripting vulnerability in Formwork before 2.3.11 that allows unauthenticated attackers to inject malicious markup. Defenders should prioritize verifying exposure and applying patches or workarounds to prevent exploitation.

• Potential injection of malicious markup in administrator browsers
• Possible exploitation by unauthenticated attackers
• Required verification of Formwork version and patch application
• Need for monitoring and incident response planning

Technical summary

The vulnerability records the Referer header host unescaped in visit tracking, allowing unauthenticated attackers to craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel. This vulnerability affects Formwork versions before 2.3.11 and has a CVSS score of 5.3. The vulnerability is classified as a stored cross-site scripting (XSS) vulnerability. Defenders should prioritize verifying exposure and applying patches or workarounds to prevent exploitation.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or workarounds to prevent exploitation.

Recommended defensive actions

• Verify Formwork version and apply patch 2.3.11 or later
• Review visit tracking configuration and Referer header handling
• Monitor for suspicious activity on the Statistics panel
• Perform a thorough review of the current Formwork installation to identify potential exposure
• Develop and implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. The CVE Program record (cve-org) and NVD detail page (nvd) offer source-provided CVE metadata and vulnerability assessment. Additional source references (ref-3, ref-4, ref-5) may provide further information on Formwork patch releases, security advisories, and vulnerability details. However, defenders should verify the accuracy of this information and be aware of potential limitations in the CVE

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.