{"id":"GHSA-gxrg-x694-283w","summary":"Solspace Freeform: Limited Twig template injection via submitted field values","details":"### Summary\n\nA limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts.\n\nUnauthenticated users could submit Twig expressions through public Freeform forms and have those expressions evaluated when the submitted values were rendered back into the form response. Confirmed impact includes disclosure of limited server/environment information, such as the PHP version and absolute filesystem paths.\n\nNo evidence was found that this issue allowed access to Craft globals, environment variables, database credentials, mailer credentials, security keys, or remote code execution in the tested environment.\n\n### Details\n\n**Plugin:** Solspace Freeform\n**Affected versions:** Freeform 5.0.0 through 5.10.13\n**CMS:** Craft CMS\n**Authentication required:** None\n**Attack vector:** Public Freeform form submission\n\nSubmitted field values were passed through Freeform’s isolated Twig renderer. As a result, Twig expressions included in submitted values could be evaluated server-side and reflected in the HTTP response.\n\nThe isolated Twig context appears to limit the available functions and globals. Confirmed accessible values were limited to PHP/core constants and Craft bootstrap constants such as:\n\n```twig\n{{ constant('PHP_VERSION') }}\n{{ constant('PHP_OS') }}\n{{ constant('CRAFT_BASE_PATH') }}\n{{ constant('CRAFT_VENDOR_PATH') }}\n```\n\nTesting did not confirm access to:\n\n```text\ncraft\ncraft.app\nalias()\ngetenv()\ndatabase credentials\nmailer credentials\nCraft security key\nCraft license key\nenvironment variables\n```\n\n### Proof of Concept\n\n1. Submit a public Freeform form.\n\n2. Inject the following payload into an email field:\n\n```twig\n{{ constant('PHP_VERSION') }}@example.com\n```\n\nThe response may reflect the evaluated PHP version, for example:\n\n```html\nvalue=\"8.2.27@example.com\"\n```\n\n3. Inject the following payload into a text field:\n\n```twig\n{{ constant('CRAFT_VENDOR_PATH') }}\n```\n\nThe response may reflect the absolute vendor path, for example:\n\n```text\n/var/www/example-site/production/vendor/\n```\n\n### Impact\n\nAn unauthenticated attacker with access to a public Freeform form could cause limited Twig expressions to be evaluated server-side.\n\nConfirmed impact includes:\n\n```text\nPHP version disclosure\nOperating system/platform disclosure\nAbsolute filesystem path disclosure\nPotential form rendering errors from malformed Twig input\n```\n\nThis could assist with environment fingerprinting or be used in combination with other vulnerabilities. However, no credential disclosure, Craft application access, arbitrary file read, or remote code execution was confirmed.\n\n### Remediation\n\nFreeform should treat submitted field values as plain user input and should not evaluate them as Twig. Twig rendering should be limited to trusted/admin-authored templates and configuration values.\n\nThis issue has been resolved by preventing submitted field values from being rendered as Twig in the affected context.","aliases":["CVE-2026-73858"],"modified":"2026-09-23T14:45:06.326194791Z","published":"2026-09-23T14:31:10Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-23T14:31:10Z","nvd_published_at":null,"cwe_ids":["CWE-1336"]},"references":[{"type":"WEB","url":"https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w"},{"type":"WEB","url":"https://github.com/solspace/craft-freeform/pull/1986"},{"type":"WEB","url":"https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b"},{"type":"PACKAGE","url":"https://github.com/solspace/craft-freeform"},{"type":"WEB","url":"https://github.com/solspace/craft-freeform/releases/tag/v5.10.14"}],"affected":[{"package":{"name":"solspace/craft-freeform","ecosystem":"Packagist","purl":"pkg:composer/solspace/craft-freeform"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.10.14"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.14.1","5.0.15","5.0.16","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.6.1","5.0.7","5.0.8","5.0.9","5.1.0","5.1.1","5.1.10","5.1.11","5.1.12","5.1.13","5.1.13.1","5.1.14","5.1.15","5.1.16","5.1.16.1","5.1.17","5.1.18","5.1.18.1","5.1.19","5.1.19.1","5.1.2","5.1.3","5.1.4","5.1.5","5.1.5.1","5.1.6","5.1.7","5.1.8","5.1.9","5.10.0","5.10.1","5.10.10","5.10.11","5.10.12","5.10.13","5.10.2","5.10.3","5.10.4","5.10.5","5.10.6","5.10.7","5.10.8","5.10.9","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.3.2","5.3.3","5.3.3.1","5.3.4","5.3.5","5.4.0","5.4.1","5.4.2","5.5.0","5.5.1","5.5.10","5.5.2","5.5.3","5.5.4","5.5.5","5.5.6","5.5.7","5.5.8","5.5.9","5.6.0","5.6.1","5.6.2","5.6.3","5.6.4","5.6.5","5.6.6","5.6.7","5.6.8","5.7.0","5.7.0.1","5.7.1","5.7.2","5.7.3","5.7.4","5.8.0","5.8.1","5.8.2","5.8.3","5.8.4","5.8.5","5.8.6","5.8.7","5.9.0","5.9.1","5.9.1.1","5.9.1.2","5.9.10","5.9.11","5.9.12","5.9.13","5.9.14","5.9.15","5.9.16","5.9.16.1","5.9.2","5.9.3","5.9.4","5.9.5","5.9.6","5.9.7","5.9.8","5.9.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gxrg-x694-283w/GHSA-gxrg-x694-283w.json","last_known_affected_version_range":"\u003c= 5.10.13"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}