View online: https://www.drupal.org/sa-contrib-2026-169 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96366 Description:  The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments. In affected configurations, Webform did not sufficiently validate a managed file upload element when processing a new submission. A user with access to submit a vulnerable webform could potentially access other managed files they were not authorized to view. This vulnerability is mitigated by the fact that a site must have a Webform with a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own webform submissions or sending uploads as email attachments. Solution:  Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By:  * Sandro Kneubühl (blackpharao) [5] * omidsec [6] Fixed By:  * Jacob Rockowitz (jrockowitz) [7] Coordinated By:  * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * cilefen (cilefen) [10] of the Drupal Security Team * Damien McKenna (damienmckenna) [11] of the Drupal Security Team * Heine Deelstra (heine) [12] of the Drupal Security Team * Drew Webber (mcdruid) [13] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [14] provisional member of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/blackpharao [6] https://www.drupal.org/u/omidsec [7] https://www.drupal.org/u/jrockowitz [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/cilefen [11] https://www.drupal.org/u/damienmckenna [12] https://www.drupal.org/u/heine [13] https://www.drupal.org/u/mcdruid [14] https://www.drupal.org/u/mohit_aghera [15] https://www.drupal.org/u/poker10 [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....