CVE-2025-52122

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).

Published: Aug 27, 2025
Updated: Aug 28, 2025
CVE: CVE-2025-52122
GHSA: GHSA-9hp3-f5g8-rccg
Severity: Critical
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWEs:

CWE-94

Affected Software
References

Software	From	Fixed in
solspace / craft-freeform	5.0.0	5.10.16

https://github.com/TimTrademark/CVE-2025-52122
https://github.com/TimTrademark/CVE-CraftCMS-Freeform

Vulnerability Database

CVE-2025-52122