CVE-2025-52122

Vulnerability

CVE-2025-52122 is a server-side template injection (SSTI) vulnerability in the Freeform plugin for CraftCMS, affecting versions 5.0.0 through before 5.10.16 [1][3]. The root cause is that Freeform implements the Twig call filter without properly validating user input, allowing untrusted data to be rendered as a Twig template [3][4].

Exploitation

An attacker with access to edit a form (i.e., can set the submission title) can craft a malicious Twig expression that gets evaluated server-side. For example, using {{ 'system' | call('curl ...') }} executes an arbitrary system command [3][4]. The attack requires the attacker to have permissions to modify the form's submission title setting, and then submit the form or have it submitted by a user [3].

Impact

Successful exploitation allows arbitrary code injection on the server, leading to full compromise of the CraftCMS site. The attacker can execute system commands, exfiltrate data, or further pivot within the infrastructure [1][3].

Mitigation

The vulnerability is fixed in Freeform version 5.10.16. Users should immediately upgrade to this patched version. No workarounds are described, and the vendor has addressed the issue in the referenced commit [3][4].