CVE-2026-105950: getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.3.13Patch 729701e59c5886685c5a1d477bdc3035e41f18b1
Event History
Frequently Asked Questions
Which versions need to be remediated?
getformwork formwork versions up to and including 2.3.12 are affected. Upgrade to version 2.3.13 or later; the identified patch is 729701e59c5886685c5a1d477bdc3035e41f18b1.
What does an attacker need to exploit this issue?
An attacker can launch the attack remotely by manipulating the formaction argument processed by DomSanitizer::sanitizeNodeAttribute. The supplied severity vector indicates low privileges and user interaction are required.
What is the likely security impact?
Successful exploitation leads to cross-site scripting through the URI Sanitizer component. The supplied assessment indicates integrity impact, with no stated confidentiality or availability impact.