CVE-2026-73858: Freeform for Craft CMS Information Disclosure

CVE-2026-73858 Overview

CVE-2026-73858 affects the Solspace Freeform plugin for Craft CMS 5, a form-building extension used to build public-facing forms. Versions 5.0.0 through 5.10.13 evaluate submitted form values through the isolated Twig renderer when those values are rendered into HTML attributes. An unauthenticated attacker can submit Twig expressions inside field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context does not expose Craft globals, environment variables, credentials, arbitrary files, or code execution paths. Confirmed impact is limited to server and environment information disclosure and possible rendering errors. The issue is fixed in Freeform version 5.10.14.

Critical Impact
Unauthenticated attackers can leak PHP, OS, and Craft filesystem-path constants through Twig expression injection in Freeform form fields.

Affected Products

Solspace Freeform plugin for Craft CMS 5, versions 5.0.0 through 5.10.13
Craft CMS 5.x installations with the Freeform plugin enabled
Public-facing Freeform forms accepting submissions from unauthenticated users

Discovery Timeline

2026-09-23 - CVE-2026-73858 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-73858

Vulnerability Analysis

The flaw is a server-side template injection variant classified under [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine). Freeform builds HTML attributes for rendered form fields by passing attribute values through an isolated Twig renderer. Because submitted form input is placed into attributes such as value, name, and id before rendering, attacker-supplied Twig expressions are evaluated at render time.

The isolated Twig environment restricts access to Craft globals, environment variables, credentials, and filesystem contents. Attackers can still read PHP constants, operating system constants, and Craft filesystem-path constants exposed to the sandbox. The result is server and environment information disclosure that aids reconnaissance and follow-on attacks.

Root Cause

The attribute-rendering pipeline in packages/plugin/src/Library/Attributes/Attributes.php did not exclude user-controlled attribute values from Twig evaluation. Any submitted value routed to an attribute was treated as a Twig template. The vendor addressed the root cause by introducing an exclusion list for attributes that commonly carry user input.

Attack Vector

The attack requires no authentication and no user interaction. An attacker submits a Freeform form with Twig syntax placed into a text field. When the server re-renders the form, for example after a validation failure, the injected expression is evaluated and its result appears in the returned HTML.

php

     public const STRATEGY_REPLACE = 'replace';
 
     private const EXCLUDED_ATTRIBUTES = ['tag'];
+    private const EXCLUDED_TWIG_ATTRIBUTES = ['value', 'name', 'id'];
 
     private array $attributes = [];

Source: Solspace Freeform commit 5f75553

The patch adds EXCLUDED_TWIG_ATTRIBUTES so that value, name, and id attributes bypass the Twig renderer and are emitted as literal strings.

Detection Methods for CVE-2026-73858

Indicators of Compromise

Form submissions containing Twig delimiters such as {{, }}, {%, or %} in text fields.
HTTP responses returning form HTML where submitted value attributes contain evaluated constants like PHP version strings or filesystem paths.
Repeated POST requests to Freeform submission endpoints from a single source using varied Twig payloads.

Detection Strategies

Inspect web server and application logs for POST requests to Freeform endpoints that include Twig syntax in form parameters.
Deploy web application firewall rules that flag Twig expression patterns in request bodies destined for Craft CMS Freeform routes.
Correlate submission attempts with response bodies that echo PHP or OS constants to confirm active probing.

Monitoring Recommendations

Enable verbose request logging on Freeform submission endpoints and retain payloads for review.
Alert on outbound responses containing patterns consistent with PHP constants such as PHP_VERSION, PHP_OS, or absolute filesystem paths.
Track the installed Freeform plugin version across Craft CMS deployments and flag any instance below 5.10.14.

How to Mitigate CVE-2026-73858

Immediate Actions Required

Upgrade the Solspace Freeform plugin to version 5.10.14 or later on every Craft CMS 5 installation.
Audit recent Freeform submission logs for Twig syntax in field values to identify prior reconnaissance activity.
Review any custom form templates that render user-submitted attribute values and confirm they do not reintroduce the Twig evaluation path.

Patch Information

Solspace released the fix in Freeform v5.10.14. The remediation adds an EXCLUDED_TWIG_ATTRIBUTES list covering value, name, and id so that user-controlled attribute content is no longer processed by the isolated Twig renderer. See the GitHub Security Advisory GHSA-gxrg-x694-283w and the pull request discussion for additional context.

Workarounds

Restrict access to Freeform submission endpoints behind a web application firewall that blocks Twig delimiters in POST parameters.
Temporarily disable public-facing Freeform forms until the plugin can be upgraded to 5.10.14.
Rate-limit submissions from unauthenticated sources to reduce the effectiveness of automated reconnaissance.

bash

# Upgrade Solspace Freeform to the patched version via Composer
composer require solspace/craft-freeform:^5.10.14
php craft plugin/install freeform
php craft up