Injection Vulnerability in Craft CMS Plugin by Solspace
CVE-2026-73858
Key Information:
- Vendor
Solspace
- Status
- Vendor
- CVE Published:
- 23 September 2026
Badges
What is CVE-2026-73858?
The Solspace Freeform plugin for Craft CMS versions 5.0.0 to 5.10.13 contains a vulnerability that allows an unauthenticated attacker to inject Twig expressions into submitted form fields. When these expressions are evaluated in the isolated Twig renderer, they can potentially reveal sensitive server and environment information, including PHP and filesystem-path constants. While the vulnerability does not expose Craft globals or allow arbitrary code execution, it can lead to information disclosure and may cause rendering errors in the output. The issue is resolved in version 5.10.14.
Affected Version(s)
craft-freeform >= 5.0.0, < 5.10.14
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.