DRUPAL-CONTRIB-2026-158: Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158

Q: Which Webform releases are affected?

Affected releases are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. The provided information does not identify a fixed release.

Q: What level of access does an attacker need?

The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and requires user interaction. An attacker therefore needs some level of authenticated access and must induce a user to interact with the malicious content.

Q: What is the expected impact if exploitation succeeds?

The supplied CVSS vector rates confidentiality and integrity impact as low, with no availability impact.

Published Oct 22, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-158

Event History

Oct 22, 2026

CVE Published

via OSV·01:21 AM

Data Sourced

via OSV·01:21 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Webform releases are affected?

Affected releases are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. The provided information does not identify a fixed release.

What level of access does an attacker need?

The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and requires user interaction. An attacker therefore needs some level of authenticated access and must induce a user to interact with the malicious content.

What is the expected impact if exploitation succeeds?

The supplied CVSS vector rates confidentiality and integrity impact as low, with no availability impact.

DRUPAL-CONTRIB-2026-158: Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Webform releases are affected?

What level of access does an attacker need?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which Webform releases are affected?

What level of access does an attacker need?

What is the expected impact if exploitation succeeds?