CVE-2026-105950

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-105950

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105950.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-105950

Aliases

GHSA-p78q-v3pr-p87j

Published

2026-10-06T15:30:18Z

Modified

2026-10-08T02:50:33Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

Details

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105950.json"
}

References

Affected packages

Git / github.com/getformwork/formwork

Affected ranges

Type

GIT

Repo

https://github.com/getformwork/formwork

Events

Introduced

ebc3980a42896e98c8a11a436114a38dbdd4a03f

Fixed

729701e59c5886685c5a1d477bdc3035e41f18b1

Fixed

f9dabf727caa11de74e5cd672a6716dad3a321d9

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "2.3.0"
        },
        {
            "last_affected": "2.3.0"
        },
        {
            "introduced": "2.3.1"
        },
        {
            "last_affected": "2.3.1"
        },
        {
            "introduced": "2.3.2"
        },
        {
            "last_affected": "2.3.2"
        },
        {
            "introduced": "2.3.3"
        },
        {
            "last_affected": "2.3.3"
        },
        {
            "introduced": "2.3.4"
        },
        {
            "last_affected": "2.3.4"
        },
        {
            "introduced": "2.3.5"
        },
        {
            "last_affected": "2.3.5"
        },
        {
            "introduced": "2.3.6"
        },
        {
            "last_affected": "2.3.6"
        },
        {
            "introduced": "2.3.7"
        },
        {
            "last_affected": "2.3.7"
        },
        {
            "introduced": "2.3.8"
        },
        {
            "last_affected": "2.3.8"
        },
        {
            "introduced": "2.3.9"
        },
        {
            "last_affected": "2.3.9"
        },
        {
            "introduced": "2.3.10"
        },
        {
            "last_affected": "2.3.10"
        },
        {
            "introduced": "2.3.11"
        },
        {
            "last_affected": "2.3.11"
        },
        {
            "introduced": "2.3.12"
        },
        {
            "last_affected": "2.3.12"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.3.0

2.3.1

2.3.10

2.3.11

2.3.12

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105950.json"