Craft CMS Plugin Formie Vulnerability in JSON Import Process

CVE-2025-32427

What is CVE-2025-32427?

The Formie plugin for Craft CMS contains a vulnerability that arises during the JSON import process. Specifically, before version 2.1.44, if a field label or handle included malicious data, the output was not properly escaped during the preview stage of the import. This lack of proper sanitization can potentially allow an attacker to manipulate the JSON export before it is imported, leading to possible security risks. It is crucial for users to ensure they are on version 2.1.44 or later to mitigate this vulnerability.

References