SA-CONTRIB-2026-161: XSS
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user with permissions to create a webform can exploit cross-site scripting (XSS) in submodule settings. This vulnerability is mitigated by the fact that an attacker must have a role with create webform and edit own webform permissions, and the Webform Entity Print module must be enabled.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Sites using Drupal Webform are exposed only when the Webform Entity Print submodule is enabled. Exploitation also requires a user role that can create webforms and edit its own webforms.
What access does an attacker need to exploit it?
An attacker must be able to create a webform and edit webforms they own. The issue is exploited through settings in the Webform Entity Print submodule.
Is a default Webform installation affected?
The available information identifies Webform Entity Print as a required condition. A site is not exposed through this issue unless that submodule is enabled.