CVE-2025-32427: Verbb Formie XSS Vulnerability

CVE-2025-32427 Overview

CVE-2025-32427 is a stored cross-site scripting (XSS) vulnerability in Formie, a form-building plugin for Craft CMS developed by Verbb. The flaw exists in versions prior to 2.1.44. When a user imports a form from JSON, the preview view fails to escape malicious content placed in field labels or handles. An attacker who tampers with a JSON export can inject script that executes when a privileged user previews the import. Because exploitation requires deliberate manipulation of the export file and user interaction to preview it, the issue is rated medium. The vulnerability is tracked under CWE-79 and fixed in Formie 2.1.44.

Critical Impact
Malicious JSON imports can execute attacker-controlled script in the Craft CMS control panel session of the importing user.

Affected Products

Verbb Formie plugin for Craft CMS, all versions prior to 2.1.44
Craft CMS installations that permit form import from JSON exports
Environments where administrators exchange form exports between staging and production

Discovery Timeline

2025-04-11 - CVE-2025-32427 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-32427

Vulnerability Analysis

Formie allows administrators to export form definitions as JSON and re-import them into other Craft CMS environments. During import, the plugin renders a preview screen that lists the fields contained in the import file, including each field's label and handle.

Prior to version 2.1.44, Formie rendered these values in the preview without proper HTML escaping. Any script or HTML placed into the label or handle properties of a field in the JSON payload is interpreted by the browser when the preview loads. This falls under CWE-79: Improper Neutralization of Input During Web Page Generation.

The execution context is the Craft CMS control panel, which grants attacker script the privileges of the previewing user. That user is typically an administrator with permission to modify forms, users, or site content.

Root Cause

The root cause is missing output encoding in the import preview template. Field metadata read from a user-supplied JSON file is written directly into the HTML response without being passed through Craft's Twig auto-escaping or an equivalent sanitizer.

Attack Vector

Exploitation is not remote-unauthenticated. An attacker must first convince an administrator to import a tampered JSON file. Typical scenarios include a supply-chain style attack against shared form templates, a malicious contributor supplying a form export, or an attacker who has obtained an export file and modifies it before returning it to the target.

Once the administrator opens the import preview, the injected payload runs and can perform any action available to that session, including creating administrator accounts, exfiltrating tokens, or modifying published content. Refer to the Verbb Formie GHSA-p9hh-mh5x-wvx3 advisory for the vendor's technical description.

Detection Methods for CVE-2025-32427

Indicators of Compromise

JSON form export files containing HTML tags, <script> elements, or JavaScript event handlers in label or handle fields.
Unexpected administrator or user account creation in Craft CMS shortly after a form import operation.
Outbound HTTP requests from control panel sessions to unfamiliar domains during or immediately after form import previews.

Detection Strategies

Inspect all Formie JSON import files for characters such as <, >, and quoted event handlers in field metadata before allowing import.
Review Craft CMS audit logs for formie/imports actions performed by non-standard accounts or from unusual source addresses.
Search web server logs for requests to Formie import preview endpoints correlated with subsequent administrative changes.

Monitoring Recommendations

Alert on installations of Formie versions earlier than 2.1.44 across managed Craft CMS deployments.
Monitor control panel sessions for anomalous XHR or fetch requests originating from the import preview view.
Track changes to user roles and permissions following any form import event.

How to Mitigate CVE-2025-32427

Immediate Actions Required

Upgrade Formie to version 2.1.44 or later on every Craft CMS environment that runs the plugin.
Restrict the Craft CMS permission to import Formie forms to a minimum set of trusted administrators.
Treat any JSON form export received from outside your organization as untrusted until reviewed.

Patch Information

Verbb released the fix in Formie 2.1.44, which adds proper output escaping to the import preview view. The patched release and full advisory are available at the Formie GHSA-p9hh-mh5x-wvx3 security advisory. Update through Composer using the standard Craft CMS plugin update workflow.

Workarounds

Disable the Formie import feature or revoke import permissions for all users until the upgrade is applied.
Manually inspect JSON exports and strip HTML from every label and handle value before performing an import.
Perform imports only in an isolated staging environment that has no access to production credentials or data.

bash

# Update Formie to the patched release via Composer
composer require verbb/formie:^2.1.44
php craft migrate/all
php craft clear-caches/all