CVE-2026-96355: Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
Published Oct 22, 2026
·Updated
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Affected Software
1 affected component
Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1
Event History
Oct 22, 2026
CVE Published
via MITRE·01:21 AM
Data Sourced
via MITRE·01:21 AM
DescriptionWeakness
Data Sourced
via OSV·01:21 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Webform versions are affected?
Affected versions are 0.0.0 through 6.2.12, and 6.3.0 through 6.3.1. The provided information does not identify a fixed version.
2
What type of impact can exploitation have?
The issue is classified as code injection caused by improper neutralization of special elements used in a template engine. The advisory title characterizes the impact as remote code execution.