The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
Impact
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
Source excerpt · OSVThis vulnerability is mitigated by the fact that an attacker must have a role with create webform and edit own webform permissions, and the Webform Entity Print module must be enabled.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 6.2.12Ecosystem versions | 6.2.12 |
| From 6.3.0 before 6.3.1Ecosystem versions | 6.3.1 |
Version evidence: OSV · DRUPAL-CONTRIB-2026-161
View original version evidence (0 explicit versions)
Original source description
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user with permissions to create a webform can exploit cross-site scripting (XSS) in submodule settings.
This vulnerability is mitigated by the fact that an attacker must have a role with create webform and edit own webform permissions, and the Webform Entity Print module must be enabled.