CVE-2026-82451 getformwork CVE debrief

Who should care

Administrators and users of Formwork installations, particularly those using version 2.3.14 or earlier, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating Formwork installations, implementing input validation and output encoding for Referer header values, and monitoring for suspicious activity related to visit tracking and administrator interactions. Additionally, security teams and vulnerability management teams should review the vulnerability and assess the potential impact on their systems.

Technical summary

The CVE-2026-82451 vulnerability is a stored cross-site scripting (XSS) issue in Formwork through 2.3.14. The vulnerability occurs because the Referer header host is not properly escaped in visit tracking, allowing unauthenticated attackers to inject malicious markup. This markup can execute in administrator browsers when viewing the Statistics panel. The vulnerability has a CVSS score of 5.3 and a severity rating of MEDIUM. Administrators and users of Formwork installations, particularly those using version 2.3.14 or earlier, should be aware of this vulnerability and take steps to mitigate it.

Defensive priority

Medium-priority defensive review recommended due to potential for XSS attacks.

Recommended defensive actions

• Review and update Formwork installations to ensure version 2.3.14 or earlier is patched or mitigated.
• Implement input validation and output encoding for Referer header values.
• Monitor for suspicious activity related to visit tracking and administrator interactions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from Vulncheck and NVD suggests a stored XSS vulnerability exists in Formwork through 2.3.14. The vulnerability is related to the Referer header host being unescaped in visit tracking. Additional review of Formwork's visit tracking mechanism and Referer header handling is recommended to understand the full scope of the vulnerability. Defenders should verify that any Formwork installations are patched or mitigated, and monitor for suspicious activity related to visit tracking and administrator interactions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.