CVE-2026-73858

Packagist/solspace/craft-freeform CVE-2026-73858: medium 5.3, EPSS 0.43%

Solspace Freeform: Limited Twig template injection via submitted field values

Action: Upgrade solspace/craft-freeform to 5.10.14 or later.

composer require solspace/craft-freeform:5.10.14

Affected

Fixed versions

Sources

• osv: GHSA-gxrg-x694-283w
• https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w
• https://github.com/solspace/craft-freeform/pull/1986
• https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b
• https://github.com/solspace/craft-freeform
• https://github.com/solspace/craft-freeform/releases/tag/v5.10.14

CVE-2026-73858 · published 2026-09-23T14:31:10Z · modified 2026-09-23T14:45:06.326194791Z · JSON