CVE-2020-28246:
Server-Side Template Injection in formio
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.87015%
CWE
Published
6/3/2022
Updated
5/3/2024
KEV Status
No
Technology
JavaScript
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
formio | npm | <= 2.0.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The provided information describes the vulnerability (SSTI in email template deletion) but lacks concrete code examples, commit diffs, or file paths to identify specific vulnerable functions. The Form.io GitHub repositories (formio/formio
and enterprise-release
) do not contain visible code changes or documentation pointing to affected functions. While the vulnerability likely exists in email template handling logic (potentially in template rendering/processing functions during deletion), insufficient technical details prevent high-confidence identification of exact functions. Vendor disputes and removal of the email templating service further complicate analysis without access to historical code versions.