CVE-2026-103542: formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Form Tools versions up to and including 3.1.1 are affected where the AJAX endpoint at /global/code/actions.php is reachable and its smart_fill function can be invoked.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and has low attack complexity, but the severity vector indicates the attacker requires low-level privileges. No user interaction is required.
Is public exploit code available?
Yes. The exploit has been published and may be used.
Is a vendor fix available?
The available information does not identify a fix. The project was notified through an issue report but had not responded at the time of publication.