DRUPAL-CONTRIB-2026-164
The advisory, in context
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs.
The submodule did not sufficiently validate access to export/import functionality. A user who could edit webform submissions and access webform results could also access the import interface, including the remote URL import path, leading to a server-side request forgery vulnerability.
Sites that do not enable the Webform Submission Export/Import submodule are not affected.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 6.2.12
Fixed in 6.2.12
From 6.3.0 before 6.3.1
Fixed in 6.3.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.2.12"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<6.2.12"
}
},
{
"events": [
{
"introduced": "6.3.0"
},
{
"fixed": "6.3.1"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">=6.3.0 <6.3.1"
}
}
],
"versions": []
}