SA-CONTRIB-2026-169: Critical severity drupal/webform vulnerability
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments. In affected configurations, Webform did not sufficiently validate a managed file upload element when processing a new submission. A user with access to submit a vulnerable webform could potentially access other managed files they were not authorized to view. This vulnerability is mitigated by the fact that a site must have a Webform with a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own webform submissions or sending uploads as email attachments.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1
Event History
Frequently Asked Questions
Which sites are realistically exposed to this issue?
Exposure requires a Webform containing a managed file upload element and a configuration that exposes submitted files. Examples given include allowing users to view their own webform submissions or sending uploaded files as email attachments.
What access does an attacker need to exploit it?
An attacker needs access to submit a vulnerable webform. The issue occurs while Webform processes a new submission containing a managed file upload element.
What could an attacker gain access to?
A user submitting the vulnerable form could potentially access other managed files that they are not authorized to view.