DRUPAL-CONTRIB-2026-175 CVE-2026-96355
The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.
- Severity
- 9.1 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 0.42%
- Chance of exploitation in the next 30 days. Higher than 36.44% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
- Fix
6.3.1- Upgrade drupal/webform to this version or later
Description
The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.
Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code when a submission is rendered. Depending on the site configuration and enabled modules, this may lead to information disclosure, stored cross-site scripting, or remote code execution.
This vulnerability is mitigated by the fact that an affected webform must be configured with a custom multiple-value item format that includes submission-value tokens. Some impacts may also depend on additional enabled modules or site-specific configuration.
Affected versions
Packagist:https://packages.drupal.org/8
| Package | Vulnerable | Fixed in |
|---|---|---|
| drupal/webform | < 6.2.12>= 6.3.0, < 6.3.1 |
6.2.126.3.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
drupal/webform Packagist:https://packages.drupal.org/8 → 6.3.1
- composer
composer require drupal/webform:^6.3.1
Severity breakdown
CVSS 3.1 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
How to prevent it
- Architecture and Design: Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
- Implementation: Use the template engine's sandbox or restricted mode, if available.
References
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| DRUPAL-CONTRIB-2026-174 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-173 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-172 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-171 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-170 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | High | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-169 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-168 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Low | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-167 The Webform module enables site builders to create forms and collect submissions. | Medium | Also affects drupal/webform |
Credits: Michael Maturi (michaelmaturi)
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor