DRUPAL-CONTRIB-2021-004
The [Webform module for Drupal 8/9](https://www.drupal.org/project/webform) includes a default Contact webform, which sends a notification email to the site…
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
5.25.0- Upgrade drupal/webform to this version or later
Description
The Webform module for Drupal 8/9 includes a default Contact webform, which sends a notification email to the site owner and a confirmation email to the email address supplied via the form.
The confirmation email can be used as an open mail relay to send an email to any email address.
This vulnerability is mitigated by the fact that the site owner's email address is also receiving a notification email, which should alert the site owner to the exploitation. If the site owner's mailbox is not monitored, the open mail relay can be more easily exploited.
With the Webform module's latest release, the default Contact's confirmation email will only be sent to an authenticated user's email address. Anonymous users will no longer receive a confirmation email.
If anonymous users need to receive a confirmation email, we recommend you add SPAM protection to the form and update the email handler.
Affected versions
Packagist:https://packages.drupal.org/8
| Package | Vulnerable | Fixed in |
|---|---|---|
| drupal/webform | < 5.25.0>= 6.0.0, <= 6.0.0>= 6.0.1, <= 6.0.1 |
5.25.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
drupal/webform Packagist:https://packages.drupal.org/8 → 5.25.0
- composer
composer require drupal/webform:^5.25.0
References
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| DRUPAL-CONTRIB-2026-175 The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. | Critical | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-174 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-173 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-172 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-171 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-170 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | High | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-169 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-168 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Low | Also affects drupal/webform |
Credits: KarinG
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor