porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories  /  composer  /  verbb

composer

verbb/formie

Security advisories for verbb/formie, newest first. 11 known, 2 without a fix yet.

RSS feed Check your lock file →

Latest version

4.0.5

Advisories

11 · 2 unfixed

Last advisory

23 Sep 2026

Safe from

no fix for all yet

11 advisories · newest first

HIGH7.7 23 Sep 2026

Formie: Missing authorization on sent notification resend modal exposes submission PII

GHSA-9rg8-2wvr-fgjh · CVE-2026-76089

Affected

< 2.2.23 ≥ 3.0.0, < 3.1.31

Fixed in

2.2.23 3.1.31
HIGH8.2 23 Sep 2026

Formie: Unauthenticated users can overwrite incomplete submissions via submit action

GHSA-584p-f93j-wpgc · CVE-2026-76087

Affected

< 2.2.23 ≥ 3.0.0, < 3.1.31

Fixed in

2.2.23 3.1.31
HIGH8.5 23 Sep 2026

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

GHSA-v3f3-cmj4-cvj9 · CVE-2026-76086

Affected

< 2.2.23 ≥ 3.0.0, < 3.1.31

Fixed in

2.2.23 3.1.31
MODERATE6.3 17 Jul 2026

Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

GHSA-cvpc-hccg-wmw4

Affected

< 3.1.28

Fixed in

3.1.28
CRITICAL9.8 6 Jul 2026

Formie Hidden field defaults vulnerable to Server-Side Template Injection

GHSA-565m-g33j-jq96 · CVE-2026-52889

Affected

< 3.1.27

Fixed in

3.1.27
HIGH 29 May 2026

formie's unauthenticated front-end submission editing can overwrite existing submissions

GHSA-pgxq-p76c-x9cg · CVE-2026-47266

Affected

< 2.2.21 ≥ 3.0.0, < 3.1.26

Fixed in

2.2.21 3.1.26
CRITICAL9.8 18 May 2026

Formie: Pre-authenticated server-side template injection in Hidden fields

GHSA-x7m9-mwc2-g6w2 · CVE-2026-45697

Affected

< 2.2.20 ≥ 3.0.0-beta.1, < 3.1.24

Fixed in

2.2.20 3.1.24
CRITICAL 18 Feb 2026

Formie 3.1.14 is a critical release

craft-critical

Affected

< 2.2.13 < 2.2.12 ≥ 3.0.0-dev, < 3.1.14
and 1 more ≥ 3.0.0-dev, < 3.1.13

Fixed in

2.2.12 2.2.13 3.1.13
and 1 more 3.1.14
MODERATE4.6 11 Apr 2025

Formie has XSS vulnerability for email notification content for preview

GHSA-2xm2-23ff-p8ww · CVE-2025-32426

Affected

≤ 2.1.43

Fixed in

no fix yet
MODERATE 11 Apr 2025

Formie has XSS vulnerability for importing forms

GHSA-p9hh-mh5x-wvx3 · CVE-2025-32427

Affected

≤ 2.1.43

Fixed in

no fix yet
MODERATE4.4 20 May 2024

verbb/formie Server-Side Template Injection for variable-enabled settings

GHSA-v45m-hxqp-fwf5 · CVE-2024-35191

Affected

< 2.1.6

Fixed in

2.1.6
/advisories/composer/verbb/formie/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →