TimTrademark/CVE-2025-52122

TimTrademark/CVE-2025-52122

GitHubGitHub
GitHubgithub.com
Releases0
Arbitrary code injection in CraftCMS Freeform 5.0.0 < 5.10.16
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2025-52122↗
9.8 CRITICAL—

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).