« Volver al listado

CVE-2026-73858

Estado: Pendiente de análisisMedia (5.3)—

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Aplicación web expuesta con entrada sin validación (CWE-1336) que permite inyección de expresiones Twig en atributos HTML. Divulga información del sistema (rutas, constantes PHP/SO) sin ejecución de código ni acceso a credenciales confirmado.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementLimit Access to Resource Over NetworkFilter Network TrafficUpdate SoftwareActive Directory ConfigurationVulnerability Scanning

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Craftcms — Craft CMSAISolspace — FreeformAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-73858",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73858",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-23T15:20:33.646811Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "solspace",
          "product": "craft-freeform",
          "versions": [
            {
              "status": "affected",
              "version": ">= 5.0.0, < 5.10.14"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-23T15:17:18.233",
  "references": [
    {
      "url": "https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/solspace/craft-freeform/pull/1986",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/solspace/craft-freeform/releases/tag/v5.10.14",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14."
    }
  ],
  "lastModified": "2026-09-23T18:12:04.247",
  "sourceIdentifier": "security-advisories@github.com"
}