Medium severity4.4NVD Advisory· Published May 20, 2024· Updated Jun 17, 2026
CVE-2024-35191
CVE-2024-35191
Description
Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This has been fixed in Formie 2.1.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
verbb/formiePackagist | < 2.1.6 | 2.1.6 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/verbb/formie/commit/90296edf7e707f117e760aa57e70dbd43a854420nvdPatchWEB
- github.com/advisories/GHSA-v45m-hxqp-fwf5ghsaADVISORY
- github.com/verbb/formie/security/advisories/GHSA-v45m-hxqp-fwf5nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-35191ghsaADVISORY
News mentions
0No linked articles in our index yet.