Executive brief
The Webform module for Drupal allows administrators to create and manage forms and collect user submissions. A submodule that handles importing submission data from CSV files and remote URLs has insufficient access controls, allowing authenticated users with certain permissions to access the import functionality and conduct server-side request forgery attacks. This could enable attackers to make unauthorized requests from the server or access sensitive internal resources.
Technical details
The Webform Submission Export/Import submodule fails to properly validate access controls on export/import endpoints. An authenticated user with permissions to edit webform submissions and view webform results can access the remote URL import path, enabling server-side request forgery (SSRF) attacks. The vulnerability affects versions prior to 6.2.12 and 6.3.0 through 6.3.1; only sites with this submodule enabled are affected.
Affected products
- Drupal Webform <6.2.12, >=6.3.0 <6.3.1
Timeline
- 2026-09-23: disclosed