CVE-2020-11056: 
PHP vulnerability analysis and mitigation

CVE-2020-11056 is a Server-Side Template Injection (SSTI) vulnerability discovered in Sprout Forms before version 3.9.0. The vulnerability was identified in early 2020 and disclosed on May 4, 2020. The issue specifically affects the custom fields functionality in Notification Emails, which could potentially lead to the execution of unauthorized Twig code (GitHub Advisory).

The vulnerability exists in the Sprout Forms plugin's Notification Email feature when using custom fields. The issue specifically affects versions of barrelstrength/sprout-base-email below 1.2.7. The vulnerability is classified as Critical severity, allowing potential execution of Twig code through template injection (GitHub Advisory).

If exploited, this vulnerability could allow attackers to execute arbitrary Twig code through template injection in the application. This poses a significant security risk as it could potentially lead to unauthorized code execution within the application context (GitHub Advisory).

The vulnerability requires access to the Notification Emails functionality within Sprout Forms. The specific attack vector involves manipulation of custom fields within Notification Email templates (GitHub Advisory).

The vulnerability has been patched in Sprout Forms version 3.9.0, which includes the updated barrelstrength/sprout-base-email version 1.2.7. For users unable to upgrade immediately, a recommended workaround is to update any Notification Emails to use the 'Basic Notification (Sprout Email)' template and avoid using the 'Basic Notification (Sprout Forms)' template or any custom templates that display Form Fields (GitHub Advisory).

The vulnerability was discovered and responsibly disclosed by Paweł Hałdrzyński and Daniel Kalinowski from ISEC.PL. The vendor responded by releasing a critical security update to address the issue (GitHub Advisory).