CVE-2025-52122

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-08-27 · updated 2026-06-17
Weakness: CWE-94

Description

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).

Affected products

solspace craft-freeform: from 5.0.0 before 5.10.16 — fixed in 5.10.16

How to fix

Upgrade to a fixed version: solspace craft-freeform 5.10.16. Check the vendor advisory for mitigations.

References

https://github.com/TimTrademark/CVE-2025-52122
https://github.com/TimTrademark/CVE-CraftCMS-Freeform

Get alerted when CVE-2025-52122 or the next vulnerability affects your stack