# DRUPAL-CONTRIB-2021-004 - The [Webform module for Drupal 8/9](https://www.drupal.org/project/webform) includes a…

Source: https://junglewise.ai/threats/drupal-contrib-2021-004-the-webform-module-for-drupal-8-9-https-www-51b49bb7  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-03-03  
License: CC BY 4.0 with a link back

Severity: info · Published 2021-03-03

The [Webform module for Drupal 8/9](https://www.drupal.org/project/webform) includes a default Contact webform, which sends a notification email to the site owner and a confirmation email to the email address supplied via the form.

The confirmation email can be used as an open mail relay to send an email to any email address.

This vulnerability is mitigated by the fact that the site owner's email address is also receiving a notification email, which should alert the site owner to the exploitation. If the site owner's mailbox is not monitored, the open mail relay can be more easily exploited.

With the Webform module's latest release, the default Contact's confirmation email will only be sent to an authenticated user's email address. Anonymous users will no longer receive a confirmation email.

If anonymous users need to receive a confirmation email, we recommend you add SPAM protection to the form and update the email handler.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform](https://junglewise.ai/threats/technologies/drupal-webform). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 3 March 2021.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform ECOSYSTEM:introduced=0,fixed=5.25.0|ECOSYSTEM:introduced=6.0.0,last_affected=6.0.0|ECOSYSTEM:introduced=6.0.1,last_affected=6.0.1.

**Is there a fix for This vulnerability?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform: upgrade to 5.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform: upgrade to 5.25.0 or later

## Affected products

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Webform ECOSYSTEM:introduced=0,fixed=5.25.0|ECOSYSTEM:introduced=6.0.0,last_affected=6.0.0|ECOSYSTEM:introduced=6.0.1,last_affected=6.0.1

## Related threats

- [Drupal Webform module access bypass in submission view modes](https://junglewise.ai/threats/cve-2026-96398-drupal-contrib-2026-173-the-webform-module-allows-site-builders)
- [Drupal Webform access bypass in export filename validation](https://junglewise.ai/threats/cve-2026-96373-drupal-contrib-2026-168-the-webform-module-allows-site-builders)
- [Drupal Webform module insufficient access restriction on remote HTTP operations](https://junglewise.ai/threats/cve-2026-96372-drupal-contrib-2026-167-the-webform-module-enables-site-builders)
- [Drupal Webform module cross-site scripting in source editing](https://junglewise.ai/threats/cve-2026-96371-drupal-contrib-2026-166-the-webform-module-allows-site-builders)
- [Drupal Webform Submission Export/Import server-side request forgery](https://junglewise.ai/threats/cve-2026-96370-drupal-contrib-2026-164-the-webform-module-allows-site-builders)