SA-CONTRIB-2026-158: Critical severity drupal/webform vulnerability
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a rating element. This vulnerability is mitigated by the fact that an attacker must be able to place crafted HTML markup on the same page as a Webform rating element.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Sites using the Webform module's rating element are exposed only where an attacker can place crafted HTML markup on the same page as that rating element. The advisory does not indicate that the rating element alone is sufficient for exploitation.
What does an attacker need to exploit it?
An attacker must be able to place crafted HTML markup on the same page as a Webform rating element. This prerequisite mitigates the vulnerability.