SA-CONTRIB-2026-164: Critical severity drupal/webform vulnerability
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not sufficiently validate access to export/import functionality. A user who could edit webform submissions and access webform results could also access the import interface, including the remote URL import path, leading to a server-side request forgery vulnerability. Sites that do not enable the Webform Submission Export/Import submodule are not affected.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1 - Configuration
Keep the Webform Submission Export/Import submodule disabled; sites that do not enable it are not affected.
Webform Submission Export/Import submodule enabled = false
Event History
Frequently Asked Questions
Which sites are affected?
Only sites with the Webform Submission Export/Import submodule enabled are affected. Sites that do not enable this submodule are not affected.
What access does an attacker need to exploit this issue?
The attacker must be able to edit webform submissions and access webform results. Users with both permissions could reach the import interface and its remote URL import path.
What is the impact of the remote URL import path?
It can be used to trigger server-side request forgery, causing the server to make requests to a URL supplied through the import functionality.