Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-52889.
Unlock with Pro - from £29/user/moDetect Formie Hidden Field Default Server-Side Template Injection (CVE-2026-52889) in Microsoft Sentinel
Detects exploitation attempts against CVE-2026-52889, a Server-Side Template Injection (SSTI, CWE-1336) vulnerability in the Formie plugin (verbb/formie) for Craft CMS. The vulnerability exists in how Formie processes 'default value' expressions for Hidden form fields, allowing an unauthenticated or low-privileged attacker to inject Twig template syntax that is evaluated server-side, potentially leading to remote code execution. Affects verbb/formie < 3.1.27. Detection focuses on Twig/Craft template injection payload patterns in form submission requests, anomalous POST bodies to Formie submission endpoints, and resulting web shell / RCE indicators (process spawning from PHP-FPM/Craft, outbound connections, file writes to web root).
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
let SSTIPatterns = dynamic(['{{', '}}', '{%', 'system(', 'exec(', 'passthru(', '_self.env', 'getFilter', 'RCE', 'file_get_contents', 'proc_open']);
W3CIISLog
| where csUriStem has_any ("/actions/formie", "/formie/", "/submit")
| where csMethod == "POST"
| extend DecodedQuery = url_decode(csUriQuery)
| where DecodedQuery has_any (SSTIPatterns) or csUriQuery has_any (SSTIPatterns)
| project TimeGenerated, cIP, csUriStem, csUriQuery, csUserAgent, scStatus
| union (
AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where requestUri_s has_any ("/actions/formie", "/formie/")
| where details_data_s has_any (SSTIPatterns)
| project TimeGenerated, cIP=clientIp_s, csUriStem=requestUri_s, csUriQuery=details_data_s, csUserAgent="", scStatus=toint(0)
)
| summarize AttemptCount = count(), Payloads = make_set(csUriQuery, 10) by cIP, csUriStem, bin(TimeGenerated, 5m)
| where AttemptCount >= 1Detects HTTP POST requests to Formie form submission endpoints containing Twig/PHP SSTI payload markers indicative of CVE-2026-52889 exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Security scanners or QA fuzz testing legitimately probing form fields with template-like strings
- Legitimate Formie users pasting Twig-like documentation examples into free-text fields
- Automated vulnerability scanners (e.g. Burp, Nuclei) run by the organization's own red team
Other platforms for CVE-2026-52889
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Formie Hidden Field SSTI Payload Submission
Expected signal: Web server access log entry recording a POST to /actions/formie/submissions/submit containing the Twig SSTI payload string in the request body.
- Test 2Formie SSTI to Command Execution Simulation
Expected signal: EDR/auditd process creation events showing 'bash' spawned as a child of a process running under the www-data (or equivalent web server) user, executing 'id', 'whoami', and 'uname -a'.
- Test 3Formie Malicious Webshell Drop Simulation
Expected signal: File integrity monitoring / EDR file-creation event for a new .php file written under the web root by the web server process user shortly after a Formie form submission.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-52889 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month