AIKIDO-2026-678815

TL;DR

Formie merges incoming request query-string parameters into configured form redirect URLs, which are then processed through the Twig template renderer during public form submissions. Because request-derived query values are evaluated as object-template syntax rather than treated as literal data, unauthenticated submitters can inject Twig expressions that are evaluated server-side and reflected in redirect responses, bypassing the HMAC protection applied to posted redirect parameters. The fix renders redirect URLs through a restricted renderer and encodes request query values as literal URL data instead of evaluating them as template syntax.