CVE-2025-52122: Solspace Freeform

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).

Affected products

• Solspace Freeform: from 5.0.0, before 5.10.16 (fixed in 5.10.16)

Published 2025-08-27. Last modified 2026-06-17.