SA-CONTRIB-2026-175: Critical severity drupal/webform vulnerability
The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code when a submission is rendered. Depending on the site configuration and enabled modules, this may lead to information disclosure, stored cross-site scripting, or remote code execution. This vulnerability is mitigated by the fact that an affected webform must be configured with a custom multiple-value item format that includes submission-value tokens. Some impacts may also depend on additional enabled modules or site-specific configuration.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1
Event History
Frequently Asked Questions
Which Webform configurations are exposed?
An affected webform must use a custom multiple-value item format that includes submission-value tokens. Impact also depends on the site's configuration and, for some outcomes, additional enabled modules.
What does an attacker need to exploit this issue?
The attacker needs to be able to submit data to a webform whose configured rendering format includes submission-value tokens. Their submitted value can then be evaluated as template code when the submission is rendered.
How can administrators identify potentially affected forms?
Review webforms for custom multiple-value item formats and determine whether those formats include submission-value tokens. Forms without that required configuration are not described as affected by this issue.