DRUPAL-CONTRIB-2026-172: Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

Q: Which deployments are affected?

Drupal sites using Webform versions from 0.0.0 through 6.2.12, or from 6.3.0 through 6.3.1, are affected.

Q: What access does an attacker need to exploit the issue?

The provided CVSS vector indicates that an attacker needs low-level privileges and user interaction. The attack can be conducted over the network with low attack complexity.

Q: What is the impact if exploitation succeeds?

The issue allows stored cross-site scripting. The CVSS vector indicates low confidentiality impact and low integrity impact, with no availability impact.

Published Oct 22, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal Webform to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-172

Event History

Oct 22, 2026

CVE Published

via OSV·01:21 AM

Data Sourced

via OSV·01:21 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Drupal sites using Webform versions from 0.0.0 through 6.2.12, or from 6.3.0 through 6.3.1, are affected.

What access does an attacker need to exploit the issue?

The provided CVSS vector indicates that an attacker needs low-level privileges and user interaction. The attack can be conducted over the network with low attack complexity.

What is the impact if exploitation succeeds?

The issue allows stored cross-site scripting. The CVSS vector indicates low confidentiality impact and low integrity impact, with no availability impact.

DRUPAL-CONTRIB-2026-172: Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit the issue?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit the issue?

What is the impact if exploitation succeeds?