CVE-2026-52889 verbb CVE debrief

Who should care

Defenders of Craft CMS deployments using the Formie plugin, particularly those with public-facing forms, should assess exposure and prioritize upgrading to version 3.1.27 or later.

Why it matters

CVE-2026-52889 is a critical vulnerability in the Formie plugin for Craft CMS, allowing an unauthenticated attacker to inject Twig syntax and potentially achieve remote code execution, information disclosure, or application state modification. Defenders of Craft CMS deployments using the Formie plugin, particularly those with public-facing forms, should assess exposure and prioritize upgrading to version 3.1.27 or later.

• Potential remote code execution
• Information disclosure through Twig syntax injection
• Application state modification
• Verification of Craft site configuration and Twig capabilities required

Technical summary

The Formie plugin for Craft CMS passes request-derived Hidden field defaults to Craft's Twig rendering layer during front-end form rendering, allowing an unauthenticated attacker to inject Twig syntax and potentially achieve remote code execution, information disclosure, or application state modification. The vulnerability's impact depends on the Craft site configuration and available Twig capabilities. The issue is fixed in version 3.1.27 of the Formie plugin. Defenders should review the configuration and capabilities to assess potential impact and monitor for suspicious activity.

Defensive priority

High

Recommended defensive actions

• Upgrade to Formie version 3.1.27 or later
• Review Craft site configuration and available Twig capabilities to assess potential impact
• Monitor for suspicious activity on affected deployments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, the exact scope of affected deployments and potential exploitation remains unknown. The vulnerability allows an unauthenticated attacker to inject Twig syntax through request-derived Hidden field defaults. The issue is fixed in version 3.1.27 of the Formie plugin. Defenders should verify the Craft site configuration and available Twig capabilities to assess exposure and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.