Improper Validation of Specified Index, Position, or Offset in Input Affecting getformwork/formwork package, versions >=0.0.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-GETFORMWORKFORMWORK-9055238
- published2 Mar 2025
- disclosed1 Mar 2025
- creditKyokito1412
Introduced: 1 Mar 2025
New CVE NOT AVAILABLE CWE-1285 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
getformwork/formwork is an a file-based Content Management System (CMS) to make and manage simple sites.
Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to improper user input sanitization passed through the Role field on the /panel/users/{name}/profile page. An attacker can disrupt the availability of the site and administration panel by injecting invalid user role values. This is only exploitable if the attacker has high privileges or admin access.