[IT-SecNots] [Security-news] Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-175

Project: Webform [1]
Project machine name: webform
Date: 2026-September-23
Security risk: *Critical* 18 ∕ 25
AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon [2]
Vulnerability: Remote Code Execution

Affected versions: <6.2.12 || >=6.3.0 <6.3.1
CVE IDs: CVE-2026-96355
Description: 
The Webform module allows site builders to create forms, collect submissions,
and render submitted values in configurable formats.

Webform does not sufficiently exclude certain format templates from token
replacement. This can allow an attacker to submit data that is evaluated as
template code when a submission is rendered. Depending on the site
configuration and enabled modules, this may lead to information disclosure,
stored cross-site scripting, or remote code execution.

This vulnerability is mitigated by the fact that an affected webform must be
configured with a custom multiple-value item format that includes
submission-value tokens. Some impacts may also depend on additional enabled
modules or site-specific configuration.

Solution: 
Install the latest version:

 * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3].
 * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4].

Reported By: 
 * Michael Maturi (michaelmaturi) [5]

Fixed By: 
 * Jacob Rockowitz (jrockowitz) [6]
 * Liam Morland (liam morland) [7]

Coordinated By: 
 * Swan Kalata (akalata) [8] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [9] of the Drupal Security Team
 * Greg Knaddison (greggles) [10] of the Drupal Security Team
 * Jess  (xjm) [11] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [12]

[1] https://www.drupal.org/project/webform
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/webform/releases/6.2.12
[4] https://www.drupal.org/project/webform/releases/6.3.1
[5] https://www.drupal.org/u/michaelmaturi
[6] https://www.drupal.org/u/jrockowitz
[7] https://www.drupal.org/u/liam-morland
[8] https://www.drupal.org/u/akalata
[9] https://www.drupal.org/u/bramdriesen
[10] https://www.drupal.org/u/greggles
[11] https://www.drupal.org/u/xjm
[12]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3595570

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at