DRUPAL-CONTRIB-2026-175: Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Q: Which Webform versions require remediation?

The affected ranges are Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. Versions outside those stated ranges are not identified as affected by the provided data.

Q: Does exploitation require an authenticated account or user interaction?

No. The supplied vector lists PR:N and UI:N, indicating no privileges and no user interaction are required for exploitation.

Q: Can this issue be exploited remotely?

Yes. The attack vector is network-based (AV:N), and the issue is described as allowing code injection.

Q: What impact could successful exploitation have?

The vector indicates high confidentiality and integrity impact (C:H and I:H). Availability impact is listed as none (A:N).

Published Oct 22, 2026

Updated

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal Webform to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-175

Event History

Oct 22, 2026

CVE Published

via OSV·01:21 AM

Data Sourced

via OSV·01:21 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Webform versions require remediation?

The affected ranges are Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. Versions outside those stated ranges are not identified as affected by the provided data.

Does exploitation require an authenticated account or user interaction?

No. The supplied vector lists PR:N and UI:N, indicating no privileges and no user interaction are required for exploitation.

Can this issue be exploited remotely?

Yes. The attack vector is network-based (AV:N), and the issue is described as allowing code injection.

What impact could successful exploitation have?

The vector indicates high confidentiality and integrity impact (C:H and I:H). Availability impact is listed as none (A:N).

DRUPAL-CONTRIB-2026-175: Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Webform versions require remediation?

Does exploitation require an authenticated account or user interaction?

Can this issue be exploited remotely?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which Webform versions require remediation?

Does exploitation require an authenticated account or user interaction?

Can this issue be exploited remotely?

What impact could successful exploitation have?