SA-CONTRIB-2026-161: XSS

Published Sep 23, 2026
·
Updated

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user with permissions to create a webform can exploit cross-site scripting (XSS) in submodule settings. This vulnerability is mitigated by the fact that an attacker must have a role with create webform and edit own webform permissions, and the Webform Entity Print module must be enabled.

Credit

Pierre Rudloff (prudloff)(the Drupal Security Team)

Affected Software

1 affected componentFixes available
drupal/webform<6.2.12, <6.3.1
6.2.126.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade drupal/webform to a version that resolves this vulnerability.

    Fixed in 6.2.12Fixed in 6.3.1

Event History

Sep 23, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

Who is exposed to this vulnerability?

Sites using Drupal Webform are exposed only when the Webform Entity Print submodule is enabled. Exploitation also requires a user role that can create webforms and edit its own webforms.

2

What access does an attacker need to exploit it?

An attacker must be able to create a webform and edit webforms they own. The issue is exploited through settings in the Webform Entity Print submodule.

3

Is a default Webform installation affected?

The available information identifies Webform Entity Print as a required condition. A site is not exposed through this issue unless that submodule is enabled.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203