The vulnerability exists in the Formie plugin for Craft 5, specifically in the Hidden field type when configured with dynamic default values derived from HTTP requests (User Agent, Referer URL, Current URL, Query Parameter, or Cookie Value). These values were passed unchecked to Craft's Twig rendering engine during front-end form rendering, allowing unauthenticated attackers to inject and execute arbitrary Twig code server-side. The flaw is due to improper handling of request-derived defaults, which were rendered as Twig templates instead of plain strings. The patch in version 3.1.27 restricts Twig rendering to admin-authored templates only, treating request-derived defaults as plain text.

An unauthenticated attacker can exploit this vulnerability by visiting a public form with a vulnerable Hidden field, injecting malicious Twig syntax via request parameters. This can result in disclosure of sensitive information, unauthorized modification of application state, or remote code execution, depending on the server's Twig environment and configuration. The vulnerability is critical due to its potential for full system compromise without authentication.

Update Formie to version 3.1.27 or later, where this vulnerability is patched. Until the update is applied, avoid using request-derived default values in Hidden fields on public forms, including HTTP User Agent, Referer URL, Current URL, Query Parameters, and Cookie Values. Alternatively, remove any affected Hidden fields from public forms to prevent exploitation.