Executive brief
The Webform module for Drupal allows site administrators to build forms and collect user submissions, including file uploads. A misconfiguration in how uploaded files are served could cause certain file types to be displayed inline in a browser rather than downloaded, enabling attackers to inject malicious scripts. An attacker would need form creator permissions to enable vulnerable file types and a victim to open a malicious uploaded file.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Webform module's file serving mechanism. The module fails to force Content-Disposition: attachment headers for certain file types, allowing inline rendering instead of download. Under specific site configurations, an uploaded file with dangerous content (e.g., HTML or SVG with embedded scripts) could execute in a user's browser when accessed, though exploitation requires both form creator permissions and user interaction.
Affected products
- Drupal Webform before 6.2.12, or 6.3.0 before 6.3.1
Timeline
- 2026-09-23: disclosed