CVE-2026-52889: Server-Side Template Injection in Formie for Craft CMS via Hidden Field Defaults

What's the Vulnerability

CVE-2026-52889 is a Server-Side Template Injection (SSTI, CWE-1336) vulnerability in verbb/formie, a widely-used form-building plugin for Craft CMS. The flaw lies in how Formie evaluates 'default value' expressions configured on Hidden form fields. Because these expressions are processed through Twig at render or submission time without adequate sandboxing, an unauthenticated or low-privileged attacker can inject Twig syntax that gets evaluated server-side. Successful exploitation can escalate from template injection to full remote code execution (RCE) on the underlying Craft CMS host, given a CVSS score of 9.8 (Critical).

Affected Software

• Vendor/Ecosystem: Composer (PHP)
• Product: verbb/formie (Craft CMS plugin)
• Affected Versions: < 3.1.27

No patched version date has been recorded yet in our tracking; organizations running Formie on Craft CMS should treat any version prior to 3.1.27 as vulnerable and prioritize remediation.

Exploitation Status

This vulnerability is currently classified as poc-public — a proof-of-concept exploit has been publicly disclosed (disclosed 2026-07-06), but it has not yet been confirmed as actively weaponized in the wild or added to CISA's Known Exploited Vulnerabilities (KEV) catalog. For defenders, poc-public status means the barrier to exploitation is low and opportunistic scanning/exploitation attempts should be expected soon, even absent confirmed in-the-wild campaigns.

How Our Detection Catches It

We ship coverage for this technique across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL). The detection logic operates in three layers:

• Payload identification: inspecting POST bodies submitted to Formie form-submission endpoints for Twig/Craft template injection syntax and known SSTI payload patterns targeting hidden-field default values.
• Anomaly detection: flagging unusual or malformed POST request structures to Formie endpoints that deviate from expected form submission shapes.
• Post-exploitation indicators: correlating web application activity with downstream signs of successful RCE, including unexpected process spawning from PHP-FPM or the Craft CMS process, anomalous outbound network connections, and unauthorized file writes into the web root (a common indicator of web shell deployment).

Combining request-level payload detection with host and network-level post-exploitation signals gives defenders coverage both at the point of attempted exploitation and in the event a payload slips through initial filtering.

Get the Full Detection

For the complete KQL, SPL, and other SIEM queries, MITRE ATT&CK mapping, and additional response guidance, see the full detection page for CVE-2026-52889 on df00tech.