Getformwork Formwork vulnerabilities

CVE-2026-27198 [HIGH] CWE-269 CVE-2026-27198: Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles

CVE-2025-65956 [MEDIUM] CWE-79 CVE-2025-65956: Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting uns Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cross‑site scripting (XSS). Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. The issue is p

CVE-2024-37160 [MEDIUM] CWE-79 CVE-2024-37160: Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). This vulnerability is fixed in 1.13.1.

CVE-2024-35621 [MEDIUM] CWE-79 formwork Cross-site scripting vulnerability in Markdown fields formwork Cross-site scripting vulnerability in Markdown fields ### Impact Users with access to the administration panel with page editing permissions could insert `` tags in markdown fields, which are exposed on the publicly accessible site pages, leading to potential XSS injections. ### Patches - [**Formwork 1.13.0**](https://github.com/getformwork/formwork/releases/tag/1.13.0) has been released wit

CVE-2023-24230 [MEDIUM] CWE-79 Formwork Cross-site Scripting (XSS) from Page title field Formwork Cross-site Scripting (XSS) from Page title field ### Description A stored cross-site scripting (XSS) vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field. Only users with access to Administration Panel with page editing permission can inject raw HTML in the Page title field. ### Patched versions This v