Executive brief
The Webform module for Drupal allows site administrators to create forms and display submitted data. A vulnerability in how the module processes form submissions allows attackers to inject template code through form fields, which gets executed when administrators view the submission. Depending on site configuration, this could lead to data theft, website defacement, or complete server compromise.
Technical details
The Webform module fails to properly sanitize token replacement in custom format templates, allowing attackers to submit malicious template code that is evaluated at render time. The vulnerability requires a webform to be configured with a custom multiple-value item format containing submission-value tokens. Impact ranges from information disclosure and stored XSS to remote code execution depending on enabled modules and site configuration.
Affected products
- Drupal Webform <6.2.12 or >=6.3.0 <6.3.1
Timeline
- 2026-09-23: disclosed: Security advisory published
- 2026-09-23: patched: Fixes available in versions 6.2.12 and 6.3.1