Formwork Project - vulnerabilities (CVEs)

6 CVEs in 1 products, 1 in the last 30 days, newest from 2026-10-02.

Products

CVE-2026-104478 - CVSS 7.1 (high), 2026-10-02: Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files.…
CVE-2026-82451 - CVSS 6.1 (medium), 2026-08-29: Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated…
CVE-2026-27198 - CVSS 8.8 (high), 2026-02-21: Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based…
CVE-2025-65956 - CVSS 6.5 (medium), 2025-11-26: Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored…
CVE-2024-37160 - CVSS 4.8 (medium), 2024-06-07: Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying…
CVE-2023-24230 - CVSS 4.8 (medium), 2023-02-10: A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web…