September 2026 - Security-news

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-155 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96361 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. Under certain configurations, this can allow markup from counter-related settings to be inserted into the page leading to a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to create or edit affected Webform elements, or place specially crafted counter markup on a page where the Webform counter JavaScript is active. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By: * Jacob Rockowitz (jrockowitz) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Pierre Rudloff (prudloff) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/jrockowitz [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/prudloff [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/prudloff [13] https://www.drupal.org/u/xjm [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-160 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96362 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Remote Post Handlers send webform data to other servers via APIs. The module does not sufficiently filter response values from the Remote Post handler before those values are rendered through handler response tokens. If a site uses Remote Post handler response tokens in rendered output, values returned by a configured remote endpoint could be rendered as HTML, resulting in a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to control or influence the response from a configured remote endpoint, and the site must use Remote Post handler response tokens in rendered output. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Brian Willows (hsjbrianwillows) [5] Fixed By: * Jacob Rockowitz (jrockowitz) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * cilefen (cilefen) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/hsjbrianwillows [6] https://www.drupal.org/u/jrockowitz [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/cilefen [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/xjm [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-161 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96363 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user with permissions to create a webform can exploit cross-site scripting (XSS) in submodule settings. This vulnerability is mitigated by the fact that an attacker must have a role with /create webform/ and /edit own webform/ permissions, and the Webform Entity Print module must be enabled. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By: * Dan Chadwick (danchadwick) [6] * Jacob Rockowitz (jrockowitz) [7] * Liam Morland (liam morland) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * cilefen (cilefen) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Jess (xjm) [15] of the Drupal Security Team * Cathy Theys (yesct) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/danchadwick [7] https://www.drupal.org/u/jrockowitz [8] https://www.drupal.org/u/liam-morland [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/cilefen [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/mrbaileys [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/xjm [16] https://www.drupal.org/u/yesct [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-171 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Exploit/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96364 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The Webform Share submodule can expose a webform for embedding on another site. Under certain circumstances, submissions for an Ajax-enabled Webform using Webform Share can bypass anti-spam protections. This vulnerability is mitigated by the fact that Webform Share must be enabled, sharing must be enabled for the affected webform, and the affected webform must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * karing [5] Fixed By: * Alan Dixon (adixon) [6] * Dan Chadwick (danchadwick) [7] * Jacob Rockowitz (jrockowitz) [8] * Liam Morland (liam morland) [9] Coordinated By: * Swan Kalata (akalata) [10] of the Drupal Security Team * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Damien McKenna (damienmckenna) [12] of the Drupal Security Team * Mori Sugimoto (dokumori) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Jess (xjm) [15] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [16] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/karing [6] https://www.drupal.org/u/adixon [7] https://www.drupal.org/u/danchadwick [8] https://www.drupal.org/u/jrockowitz [9] https://www.drupal.org/u/liam-morland [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/damienmckenna [13] https://www.drupal.org/u/dokumori [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/xjm [16] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-170 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Less critical* 8 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Denial of service Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96365 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Forms may be displayed in blocks. Webform does not sufficiently validate an optional token query value before using it. Under specific configurations where a Webform is rendered for anonymous visitors, a malicious request can cause the request to consume significant resources leading to a Denial of Service. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Majdi Alomari (majdi) [5] Fixed By: * Jacob Rockowitz (jrockowitz) [6] * Liam Morland (liam morland) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * cilefen (cilefen) [10] of the Drupal Security Team * Damien McKenna (damienmckenna) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [13] of the Drupal Security Team * Jess (xjm) [14] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [15] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/majdi [6] https://www.drupal.org/u/jrockowitz [7] https://www.drupal.org/u/liam-morland [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/cilefen [11] https://www.drupal.org/u/damienmckenna [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/mrbaileys [14] https://www.drupal.org/u/xjm [15] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-169 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96366 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments. In affected configurations, Webform did not sufficiently validate a managed file upload element when processing a new submission. A user with access to submit a vulnerable webform could potentially access other managed files they were not authorized to view. This vulnerability is mitigated by the fact that a site must have a Webform with a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own webform submissions or sending uploads as email attachments. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Sandro Kneubühl (blackpharao) [5] * omidsec [6] Fixed By: * Jacob Rockowitz (jrockowitz) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * cilefen (cilefen) [10] of the Drupal Security Team * Damien McKenna (damienmckenna) [11] of the Drupal Security Team * Heine Deelstra (heine) [12] of the Drupal Security Team * Drew Webber (mcdruid) [13] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [14] provisional member of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/blackpharao [6] https://www.drupal.org/u/omidsec [7] https://www.drupal.org/u/jrockowitz [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/cilefen [11] https://www.drupal.org/u/damienmckenna [12] https://www.drupal.org/u/heine [13] https://www.drupal.org/u/mcdruid [14] https://www.drupal.org/u/mohit_aghera [15] https://www.drupal.org/u/poker10 [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-162 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96367 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to the custom attributes YAML editor. Users with permission to create or edit webforms (but without permission to edit webform source) may be able to add custom attributes, leading to cross-site scripting. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit webforms. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Mitch Portier (arkener) [5] Fixed By: * Dan Chadwick (danchadwick) [6] * Jacob Rockowitz (jrockowitz) [7] * Liam Morland (liam morland) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * Damien McKenna (damienmckenna) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Pierre Rudloff (prudloff) [13] of the Drupal Security Team * Jess (xjm) [14] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [15] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/arkener [6] https://www.drupal.org/u/danchadwick [7] https://www.drupal.org/u/jrockowitz [8] https://www.drupal.org/u/liam-morland [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/damienmckenna [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/prudloff [14] https://www.drupal.org/u/xjm [15] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-163 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96368 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may add tooltips and help text to these forms. Some Webform tooltips and help text were not sufficiently sanitized, resulting in possible cross-site scripting (XSS). This vulnerability is mitigated by the fact that an attacker must have permission to create or edit affected Webform configuration or content. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By: * Jacob Rockowitz (jrockowitz) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Neil Drumm (drumm) [10] of the Drupal Security Team * Pierre Rudloff (prudloff) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/jrockowitz [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/drumm [11] https://www.drupal.org/u/prudloff [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Less critical - Access bypass - SA-CONTRIB-2026-165
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-165 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Less critical* 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96369 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that authenticated users can view their own submissions, a request to the JSON:API webform submission collection can return a cached response generated for a different user. This can allow an authenticated user to view another user's webform submission data through the JSON:API collection endpoint. This vulnerability is mitigated by the fact that JSON:API must be enabled, the affected webform must expose submissions through JSON:API, and the attacker must have an account with permission to view their own submissions for the affected webform. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Giuseppe (giuseppe87) [5] Fixed By: * Damien McKenna (damienmckenna) [6] of the Drupal Security Team * Jacob Rockowitz (jrockowitz) [7] * Lee Rowlands (larowlan) [8] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Jacob Rockowitz (jrockowitz) [12] * Juraj Nemec (poker10) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/giuseppe87 [6] https://www.drupal.org/u/damienmckenna [7] https://www.drupal.org/u/jrockowitz [8] https://www.drupal.org/u/larowlan [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/jrockowitz [13] https://www.drupal.org/u/poker10 [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-164 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass, Server-side request forgery Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96370 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not sufficiently validate access to export/import functionality. A user who could edit webform submissions and access webform results could also access the import interface, including the remote URL import path, leading to a server-side request forgery vulnerability. Sites that do not enable the Webform Submission Export/Import submodule are not affected. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. For sites that need remote imports, explicitly configure the trusted hosts in settings.php: $settings['webform_submission_export_import_csv_hosts'] = ['staging.example.com']; $settings['webform_submission_export_import_file_hosts'] = ['files.staging.example.com', '*.google.com']; Reported By: * abdo.boutanos(a)richemont.com [5] * chulhan park (cjfgks1230) [6] * Abdulhakeem Onipede (kism37) [7] * Marcus Johansson (marcus_johansson) [8] Fixed By: * Jacob Rockowitz (jrockowitz) [9] * Marcus Johansson (marcus_johansson) [10] Coordinated By: * Swan Kalata (akalata) [11] of the Drupal Security Team * Bram Driesen (bramdriesen) [12] of the Drupal Security Team * cilefen (cilefen) [13] of the Drupal Security Team * Damien McKenna (damienmckenna) [14] of the Drupal Security Team * Greg Knaddison (greggles) [15] of the Drupal Security Team * Drew Webber (mcdruid) [16] of the Drupal Security Team * Jess (xjm) [17] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [18] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/abdoboutanosrichemontcom [6] https://www.drupal.org/u/cjfgks1230 [7] https://www.drupal.org/u/kism37 [8] https://www.drupal.org/u/marcus_johansson [9] https://www.drupal.org/u/jrockowitz [10] https://www.drupal.org/u/marcus_johansson [11] https://www.drupal.org/u/akalata [12] https://www.drupal.org/u/bramdriesen [13] https://www.drupal.org/u/cilefen [14] https://www.drupal.org/u/damienmckenna [15] https://www.drupal.org/u/greggles [16] https://www.drupal.org/u/mcdruid [17] https://www.drupal.org/u/xjm [18] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0