Craft CMS Formie Plugin Twig Injection

Formie, a plugin for Craft CMS, is vulnerable to Twig injection via request-derived Hidden field defaults.

Formie versions prior to 3.1.27 pass request data to Craft's Twig rendering layer, allowing unauthenticated attackers to inject malicious Twig syntax into public forms.

This can lead to sensitive information disclosure, application state modification, or remote code execution, depending on the site's configuration.