CVE-2026-96355: Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Q: Which Webform versions are affected?

Affected versions are 0.0.0 through 6.2.12, and 6.3.0 through 6.3.1. The provided information does not identify a fixed version.

Q: What type of impact can exploitation have?

The issue is classified as code injection caused by improper neutralization of special elements used in a template engine. The advisory title characterizes the impact as remote code execution.

Published Oct 22, 2026

Updated

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which Webform versions are affected?

Affected versions are 0.0.0 through 6.2.12, and 6.3.0 through 6.3.1. The provided information does not identify a fixed version.

What type of impact can exploitation have?

The issue is classified as code injection caused by improper neutralization of special elements used in a template engine. The advisory title characterizes the impact as remote code execution.

CVE-2026-96355: Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Affected Software

Event History

Frequently Asked Questions

Which Webform versions are affected?

What type of impact can exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which Webform versions are affected?

What type of impact can exploitation have?