Formie, a Craft CMS plugin for creating forms, prior to version 3.1.27, improperly neutralizes special elements used in its template engine. Specifically, it passes request-derived hidden field defaults (such as HTTP User Agent, Referer URL, Current URL, Query Parameter, and Cookie Value) directly to Craft's Twig rendering layer during front-end form rendering. An unauthenticated attacker can inject Twig syntax into these inputs when a public form contains an affected hidden field. The method Hidden::getFrontEndInputOptions() assigns these values to defaultValue and calls renderString, causing server-side template evaluation instead of treating the input as plain strings. Depending on the Craft CMS configuration and Twig capabilities, this can lead to sensitive data disclosure, application state changes, or remote code execution. The vulnerability is addressed in Formie version 3.1.27.

Exploitation of this vulnerability can allow unauthenticated attackers to execute arbitrary Twig template code on the server. This can lead to disclosure of sensitive information, unauthorized modification of application state, or remote code execution, posing a critical risk to affected systems.

Upgrade Formie to version 3.1.27 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in 3.1.27.