[IT-SecNots] [Security-news] Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-166

Project: Webform [1]
Project machine name: webform
Date: 2026-September-23
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross-site scripting

Affected versions: <6.2.12 || >=6.3.0 <6.3.1
CVE IDs: CVE-2026-96371
Description: 
The Webform module allows site builders to create forms, collect submissions,
and configure access to forms and submission data.

The module does not sufficiently restrict access to raw webform source
editing when the Webform UI module is not enabled. This could allow a user
with webform creation or editing permissions to enter source configuration
that is rendered unsafely.

This vulnerability is mitigated by the fact that an attacker must have
permission to create or edit webforms.

Solution: 
Install the latest version.

 * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3].
 * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4].

Reported By: 
 * Pierre Rudloff (prudloff) [5] of the Drupal Security Team

Fixed By: 
 * Dan Chadwick (danchadwick) [6]
 * Jacob Rockowitz (jrockowitz) [7]
 * Lee Rowlands (larowlan) [8] of the Drupal Security Team
 * Liam Morland (liam morland) [9]
 * Juraj Nemec (poker10) [10] of the Drupal Security Team
 * Pierre Rudloff (prudloff) [11] of the Drupal Security Team

Coordinated By: 
 * Swan Kalata (akalata) [12] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [13] of the Drupal Security Team
 * cilefen  (cilefen) [14] of the Drupal Security Team
 * Damien McKenna (damienmckenna) [15] of the Drupal Security Team
 * Greg Knaddison (greggles) [16] of the Drupal Security Team
 * Jess  (xjm) [17] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [18]

[1] https://www.drupal.org/project/webform
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/webform/releases/6.2.12
[4] https://www.drupal.org/project/webform/releases/6.3.1
[5] https://www.drupal.org/u/prudloff
[6] https://www.drupal.org/u/danchadwick
[7] https://www.drupal.org/u/jrockowitz
[8] https://www.drupal.org/u/larowlan
[9] https://www.drupal.org/u/liam-morland
[10] https://www.drupal.org/u/poker10
[11] https://www.drupal.org/u/prudloff
[12] https://www.drupal.org/u/akalata
[13] https://www.drupal.org/u/bramdriesen
[14] https://www.drupal.org/u/cilefen
[15] https://www.drupal.org/u/damienmckenna
[16] https://www.drupal.org/u/greggles
[17] https://www.drupal.org/u/xjm
[18]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3611234

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at