Formwork vulnerabilities

2 known vulnerabilities in Formwork from Getformwork. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  formwork: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-104478Oct 3, 2026Getformwork

  Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated trav

• 8.8 High severity

  formwork: Improper Privilege Management

  CVE-2026-27198Feb 21, 2026Getformwork

  Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does no