Vulnerability Database

296,760

Total vulnerabilities in the database

CVE-2025-52122

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).

Published: Aug 27, 2025
Updated: Aug 28, 2025
CVE: CVE-2025-52122
GHSA: GHSA-9hp3-f5g8-rccg
Severity: Critical
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWEs:

CWE-94

Affected Software
References

Software	From	Fixed in
solspace / craft-freeform	5.0.0	5.10.16

https://github.com/TimTrademark/CVE-2025-52122
https://github.com/TimTrademark/CVE-CraftCMS-Freeform

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo