Composer verbb/formie has 10 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-52889 | Formie Hidden field defaults vulnerable to Server-Side Template Injection | critical | 9.8 | <3.1.27 | 3.1.27 |
| CVE-2026-76086 | Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials | high | 8.5 | >=3.0.0 and <3.1.31 or <2.2.23 | 3.1.31, 2.2.23 |
| CVE-2026-45697 | Formie: Pre-authenticated server-side template injection in Hidden fields | critical | 9.8 | >=3.0.0-beta.1 and <3.1.24 or <2.2.20 | 3.1.24, 2.2.20 |
| CVE-2026-76089 | Formie: Missing authorization on sent notification resend modal exposes submission PII | high | 7.7 | >=3.0.0 and <3.1.31 or <2.2.23 | 3.1.31, 2.2.23 |
| CVE-2026-76087 | Formie: Unauthenticated users can overwrite incomplete submissions via submit action | high | 8.2 | >=3.0.0 and <3.1.31 or <2.2.23 | 3.1.31, 2.2.23 |
| CVE-2026-47266 | formie's unauthenticated front-end submission editing can overwrite existing submissions | high | 0.0 | >=3.0.0 and <3.1.26 or <2.2.21 | 3.1.26, 2.2.21 |
| CVE-2024-35191 | verbb/formie Server-Side Template Injection for variable-enabled settings | medium | 4.4 | <2.1.6 | 2.1.6 |
| CVE-2025-32427 | Formie has XSS vulnerability for importing forms | medium | 0.0 | <2.1.44 | 2.1.44 |
| CVE-2025-32426 | Formie has XSS vulnerability for email notification content for preview | medium | 4.6 | <2.1.44 | 2.1.44 |
| GHSA-cvpc-hccg-wmw4 | Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration | medium | 6.3 | <3.1.28 | 3.1.28 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked