Injection Vulnerability in Craft CMS Plugin by Solspace
CVE-2026-73858

5.3MEDIUM

Key Information:

Vendor

Solspace

Status
Craft-freeform
Vendor
CVE Published:
23 September 2026

What is CVE-2026-73858?

The Solspace Freeform plugin for Craft CMS versions 5.0.0 to 5.10.13 contains a vulnerability that allows an unauthenticated attacker to inject Twig expressions into submitted form fields. When these expressions are evaluated in the isolated Twig renderer, they can potentially reveal sensitive server and environment information, including PHP and filesystem-path constants. While the vulnerability does not expose Craft globals or allow arbitrary code execution, it can lead to information disclosure and may cause rendering errors in the output. The issue is resolved in version 5.10.14.

Affected Version(s)

craft-freeform >= 5.0.0, < 5.10.14

References

https://github.com/solspace/craft-freeform/security/advis...
x_refsource_CONFIRM
https://github.com/solspace/craft-freeform/pull/1986
x_refsource_MISC
https://github.com/solspace/craft-freeform/commit/5f75553...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.