CVE-2026-103540: formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-level privileges and network access to the affected Form Tools instance. No user interaction is required.
Which deployments are affected?
Form Tools versions up to and including 3.1.1 are identified as affected. The issue is in the Client Settings component, specifically handling of the page_titles argument by Clients::updateClientSettingsTab.
Is an exploit available?
Yes. Public exploit disclosure has been reported, so the issue may be actively usable by attackers.
What can be done if no vendor fix is available?
No vendor response or fix is stated in the available data. Restrict network access to the application and limit low-privilege accounts' ability to modify Client Settings or supply page_titles values where operationally possible.