SA-CONTRIB-2026-168: Critical severity drupal/webform vulnerability
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view submission results for one webform may be able to access or remove files from the configured export temporary directory that were not generated for that webform. This vulnerability is mitigated by the fact that an attacker must have access to view submission results for a webform and must know or be able to determine a target filename.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Sites are exposed under configurations that use the Webform export temporary directory and grant users permission to view submission results for at least one webform. The affected users may be able to target files that were not generated for the webform they can view.
What does an attacker need to exploit it?
An attacker needs permission to view submission results for a webform. They must also know or be able to determine the filename of a target file in the configured export temporary directory.
What could an attacker do with this access?
They may be able to access or remove files from the configured export temporary directory, including files not generated for the webform for which they have submission-results access.