CVE-2026-73858: Solspace Freeform: Limited Twig template injection via submitted field values
Summary
A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts.
Unauthenticated users could submit Twig expressions through public Freeform forms and have those expressions evaluated when the submitted values were rendered back into the form response. Confirmed impact includes disclosure of limited server/environment information, such as the PHP version and absolute filesystem paths.
No evidence was found that this issue allowed access to Craft globals, environment variables, database credentials, mailer credentials, security keys, or remote code execution in the tested environment.
Details
Plugin: Solspace Freeform Affected versions: Freeform 5.0.0 through 5.10.13 CMS: Craft CMS Authentication required: None Attack vector: Public Freeform form submission
Submitted field values were passed through Freeform’s isolated Twig renderer. As a result, Twig expressions included in submitted values could be evaluated server-side and reflected in the HTTP response.
The isolated Twig context appears to limit the available functions and globals. Confirmed accessible values were limited to PHP/core constants and Craft bootstrap constants such as:
twig {{ constant('PHPVERSION') }} {{ constant('PHPOS') }} {{ constant('CRAFTBASEPATH') }} {{ constant('CRAFTVENDORPATH') }}
Testing did not confirm access to:
text craft craft.app alias() getenv() database credentials mailer credentials Craft security key Craft license key environment variables
Proof of Concept
1. Submit a public Freeform form.
2. Inject the following payload into an email field:
twig {{ constant('PHPVERSION') }}@example.com
The response may reflect the evaluated PHP version, for example:
html value="8.2.27@example.com"
3. Inject the following payload into a text field:
twig {{ constant('CRAFTVENDORPATH') }}
The response may reflect the absolute vendor path, for example:
text /var/www/example-site/production/vendor/
Impact
An unauthenticated attacker with access to a public Freeform form could cause limited Twig expressions to be evaluated server-side.
Confirmed impact includes:
text PHP version disclosure Operating system/platform disclosure Absolute filesystem path disclosure Potential form rendering errors from malformed Twig input
This could assist with environment fingerprinting or be used in combination with other vulnerabilities. However, no credential disclosure, Craft application access, arbitrary file read, or remote code execution was confirmed.
Remediation
Freeform should treat submitted field values as plain user input and should not evaluate them as Twig. Twig rendering should be limited to trusted/admin-authored templates and configuration values.
This issue has been resolved by preventing submitted field values from being rendered as Twig in the affected context.
Other sources
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/solspace/craft-freeformto a version that resolves this vulnerability.Fixed in 5.10.14 - Upgrade
Upgrade
Solspace Freeform for Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.14 - Configuration
Prevent submitted field values from being rendered as Twig; limit Twig rendering to trusted or administrator-authored templates and configuration values.
Solspace Freeform for Craft CMS Twig rendering of submitted field values = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can submit a public Freeform form can provide Twig expressions. Exploitation requires that the submitted value is rendered back into the form response in an affected rendering context.
What information could an attacker obtain?
Confirmed impact is limited disclosure of server or environment details, including the PHP version and absolute filesystem paths. Testing found no access to Craft globals, environment variables, database or mailer credentials, security keys, or remote code execution.
How can I determine whether my deployment is affected?
Check whether the installed Solspace Freeform version is from 5.0.0 through 5.10.13 and whether public forms render submitted field values back in their HTTP responses. The issue applies to values processed through Freeform’s isolated Twig renderer.