CVE-2025-65956
📋 TL;DR
Formwork CMS versions before 2.2.0 have a stored cross-site scripting vulnerability in the blog tag field. Attackers with CMS credentials can inject malicious scripts that execute when administrators view or edit affected blog posts. This allows privilege escalation within the administrative interface.
💻 Affected Systems
- Formwork CMS
📦 What is this software?
Formwork by Formwork Project
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to full CMS takeover, data theft, or website defacement through injected malicious scripts.
Likely Case
Session hijacking of administrative users, credential theft via keyloggers, or unauthorized CMS configuration changes.
If Mitigated
Limited impact with proper input validation and output encoding in place, though administrative workflows remain vulnerable.
🎯 Exploit Status
Exploitation requires authenticated access to CMS; stored XSS payloads are simple to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.0
Vendor Advisory: https://github.com/getformwork/formwork/security/advisories/GHSA-7j46-f57w-76pj
Restart Required: No
Instructions:
1. Backup your Formwork installation and database. 2. Download Formwork 2.2.0 from GitHub. 3. Replace existing files with new version. 4. Clear any cached data. 5. Verify functionality.
🔧 Temporary Workarounds
Input Sanitization
allManually sanitize blog tag inputs by removing HTML/JavaScript tags before storage.
Modify Formwork source to apply htmlspecialchars() or similar filtering to blog tag fields
Content Security Policy
allImplement strict CSP headers to block inline script execution in admin interface.
Add 'Content-Security-Policy: script-src 'self'' to admin panel headers
🧯 If You Can't Patch
- Restrict administrative user access to trusted personnel only
- Implement web application firewall rules to detect XSS payloads in blog tag fields
🔍 How to Verify
Check if Vulnerable:
Check Formwork version in admin panel or via composer.json; versions <2.2.0 are vulnerable.Check Version:
Check composer.json for version or view admin panel footerVerify Fix Applied:
After updating, test by attempting to insert script tags in blog tag field; they should be sanitized or escaped.📡 Detection & Monitoring
Log Indicators:
- Unusual blog tag entries containing script tags or JavaScript code
- Multiple failed login attempts followed by blog post modifications
Network Indicators:
- HTTP requests with script payloads in tag parameters
- Unusual outbound connections from admin interface
SIEM Query:
source="formwork_logs" AND (message="*<script>*" OR message="*javascript:*")