CVE-2025-52122: Critical Server-side Template Injection Vulnerability in Solspace Craft Freeform Plugin
Summary
CVE-2025-52122: The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability. Affects solspace/craft-freeform versions >= 5.0.0, < 5.10.16. Fixed in 5.10.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Solspace Craft Freeform plugin is a powerful tool designed for CraftCMS, enabling users to create and manage forms with ease. It offers features such as customizable form fields, submission management, and integration with various services. However, the plugin is vulnerable to a critical Server-side Template Injection (SSTI) vulnerability, which can lead to severe security risks for users who have access to form editing.
Vulnerability Detail
The vulnerability exists in versions 5.0.0 to before 5.10.16 of the Freeform plugin. It allows an attacker to inject arbitrary code through the form submission title, potentially compromising the server and exposing sensitive data. This vulnerability arises from improper handling of user input in templates, making it exploitable by any user with form editing permissions. The ramifications can be severe, including unauthorized access to server resources and data manipulation.
How To Fix
Minimum fixed version
5.10.16
This is the first release that contains the fix.
composer require solspace/craft-freeform:5.10.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider restricting access to form editing features to trusted users only. This can help minimize the risk of exploitation until the plugin is updated.
Conclusion
The Solspace Craft Freeform plugin has a critical vulnerability that can lead to severe security risks. It is essential to update to the latest version to protect your application from potential exploitation. Additionally, consider using tools like Vulert to monitor your dependencies for vulnerabilities.
See every vulnerability recorded for solspace/craft-freeform →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include unauthorized code execution, data breaches, and potential server compromise, which can lead to significant security incidents.
Yes, Vulert can monitor your dependencies in real-time for open-source vulnerabilities using just the composer.lock file.
If you cannot update immediately, restrict access to form editing features to trusted users to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for solspace/craft-freeform.
