DRUPAL-CONTRIB-2026-161: Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

Q: Which Webform versions are listed as affected?

Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1.

Q: What access and conditions does an attacker need to exploit this issue?

The severity vector indicates network-reachable exploitation with high attack complexity. The attacker needs high privileges, and user interaction is required.

Q: What is the expected security impact?

The severity vector indicates low confidentiality and integrity impact, with no availability impact.

Published Oct 22, 2026

Updated

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal Webform to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-161

Event History

Oct 22, 2026

CVE Published

via OSV·01:21 AM

Data Sourced

via OSV·01:21 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Webform versions are listed as affected?

Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1.

What access and conditions does an attacker need to exploit this issue?

The severity vector indicates network-reachable exploitation with high attack complexity. The attacker needs high privileges, and user interaction is required.

What is the expected security impact?

The severity vector indicates low confidentiality and integrity impact, with no availability impact.

DRUPAL-CONTRIB-2026-161: Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Webform versions are listed as affected?

What access and conditions does an attacker need to exploit this issue?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which Webform versions are listed as affected?

What access and conditions does an attacker need to exploit this issue?

What is the expected security impact?