The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.
Impact
The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.
Source excerpt · OSVThis vulnerability is mitigated by the fact that an affected webform must be configured with a custom multiple-value item format that includes submission-value tokens.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 6.2.12Ecosystem versions | 6.2.12 |
| From 6.3.0 before 6.3.1Ecosystem versions | 6.3.1 |
Version evidence: OSV · DRUPAL-CONTRIB-2026-175
View original version evidence (0 explicit versions)
Original source description
The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.
Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code when a submission is rendered. Depending on the site configuration and enabled modules, this may lead to information disclosure, stored cross-site scripting, or remote code execution.
This vulnerability is mitigated by the fact that an affected webform must be configured with a custom multiple-value item format that includes submission-value tokens. Some impacts may also depend on additional enabled modules or site-specific configuration.