Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14.
Affected: Packagist: solspace/craft-freeform
### Summary
A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts.
Unauthenticated users could submit Twig expressions through public Freeform forms and have those expressions evaluated when the submitted values were rendered back into the form response. Confirmed impact includes disclosure of limited server/environment information, such as the PHP version and absolute filesystem paths.
No evidence was found that this issue allowed access to Craft globals, environment variables, database credentials, mailer credentials, security keys, or remote code execution in the tested environment.
### Details
**Plugin:** Solspace Freeform **Affected versions:** Freeform 5.0.0 through 5.10.13 **CMS:** Craft CMS **Authentication required:** None **Attack vector:** Public Freeform form submission
Submitted field values were passed through Freeform’s isolated Twig renderer. As a result, Twig expressions included in submitted values could be evaluated server-side and reflected in the HTTP response.
The isolated Twig context appears to limit the available functions and globals. Confirmed accessible values were limited to PHP/core constants and Craft bootstrap constants such as:
```twig {{ constant('PHP_VERSION') }} {{ constant('PHP_OS') }} {{ constant('CRAFT_BASE_PATH') }} {{ constant('CRAFT_VENDOR_PATH') }} ```
Testing did not co…