CVE-2026-73858Medium· 5.3▾ TwilightPoC availableSolspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes.…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.4%
0.4% → 0.5%
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
solspace/craft-freeform >= 5.0.0, <= 5.10.13Patched in:
solspace/craft-freeform 5.10.14Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61453Medium· 6.1Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1)
CVE-2026-52762High· 7.1YesWiki is a wiki system written in PHP
CVE-2026-78164High· 8.2org.apache.camel/camel-http-common: org.apache.camel/camel-http: org.apache.camel/camel-vertx-http: org.apache.camel/camel-undertow: org.ap…
CVE-2026-55240Critical· 9.1Tianji is an open source analytics, uptime monitoring, and server status platform
CVE-2026-103849Critical· 10.0Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or…
CVE-2026-108570Medium· 6.3A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95