Drupal Security

Project: CookieCuttrProject machine name: cookiecuttrDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: >=2.0.0 <2.0.3CVE IDs: CVE-2026-96379Description: 

This module enables you to provide information and options about cookie usage.

The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission administer cookiecuttr.

Solution: 

Install the latest version:

• Upgrade to cookiecuttr 2.0.3.

Reported By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Marcus Johansson (marcus_johansson)

Fixed By: 

• Malcolm Young (malcomio)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Mermaid Diagram FieldProject machine name: mermaid_diagram_fieldDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: >=1.0.4 <1.0.9CVE IDs: CVE-2026-96384Description: 

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal.

The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content.

This vulnerability is mitigated by the fact that an attacker must have the modal display option enabled for the field, or otherwise know the route of the modal and entity ID.

Solution: 

Install the latest version:

• If you use the Mermaid Diagram Field module, upgrade to Mermaid Diagram Field 1.0.10.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Steve Wirt (swirt)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce Decoupled CheckoutProject machine name: commerce_decoupled_checkoutDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: >=1.0.0 <1.8.0CVE IDs: CVE-2026-96378Description: 

This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation.

The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order.

Solution: 

Install the latest version of the module:

• Update to Commerce Decoupled Checkout 8.x-1.8.

The standard order fields type, email, store, and order_items remain accepted by default.

Sites submitting additional custom order fields must explicitly enable them at /admin/commerce/config/decoupled-checkout. Requests containing fields outside this allowlist will be rejected.

Run database updates and configure the required customer-writable fields before resuming checkout.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Leo Pitt (leo pitt)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Project BrowserProject machine name: project_browserDate: 2026-September-23Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site request forgeryAffected versions: <2.0.3 || >=2.1.0 <2.1.5CVE IDs: CVE-2026-96374Description: 

The Project Browser module enables you to apply recipes and enable modules from the web user interface.

The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks (CSRF).

Solution: 

Install the latest version:

• If you use the 2.1.x branch, upgrade to Project Browser 2.1.5.
• If you use the 2.0.x branch, upgrade to Project Browser 2.0.3.

Reported By: 

• Tin Nguyen Huu (s4m0y3d)

Fixed By: 

• Chris Wells (chrisfromredfin)
• Tin Nguyen Huu (s4m0y3d)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: CloudProject machine name: cloudDate: 2026-September-23Security risk: Critical 15 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Remote code executionAffected versions: <7.0.1CVE IDs: CVE-2026-96376Description: 

The Cloud module enables users to manage cloud resources through Drupal.

The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary operating-system commands as the web-server user.

This vulnerability is mitigated by the fact that the Kubernetes submodule must be enabled and configured, Git must be available on the server, and an attacker must have permission to add or edit cloud server templates. Exploiting the clone path additionally requires the "launch cloud server template" permission, or the "launch approved cloud server template" permission when using the approved-template flow.

Solution: 

Install the latest version:

• If you use Cloud 7.x, upgrade to Cloud 7.0.1.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• AI Yas (ai_yas)
• Drew Webber (mcdruid) of the Drupal Security Team
• Yas Naoi (yas)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: CloudProject machine name: cloudDate: 2026-September-23Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Remote code executionAffected versions: <7.0.1CVE IDs: CVE-2026-96375Description: 

The Cloud module enables users to manage cloud infrastructure through Drupal.

The Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. An attacker who can intercept these connections may obtain secret tokens or other credentials, potentially allowing unauthorized access to the connected infrastructure.

Solution: 

If you use Cloud, install the latest version and configure certificates appropriately:

• If you use the 7.0.0 branch, update to 7.0.1.

The update enables TLS certificate verification for Kubernetes and VMware connections. Sites using a private certificate authority must configure the CA certificate path for the affected connection or ensure that the issuing CA is trusted by the PHP runtime. Run the Drupal database updates and rebuild caches after upgrading.

Reported By: 

• Kalle Kipinä (kekkis)

Fixed By: 

• AI Yas (ai_yas)
• baldwinlouie
• Yas Naoi (yas)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Critical 18 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Remote Code ExecutionAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96355Description: 

The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.

Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code when a submission is rendered. Depending on the site configuration and enabled modules, this may lead to information disclosure, stored cross-site scripting, or remote code execution.

This vulnerability is mitigated by the fact that an affected webform must be configured with a custom multiple-value item format that includes submission-value tokens. Some impacts may also depend on additional enabled modules or site-specific configuration.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Michael Maturi (michaelmaturi)

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Liam Morland (liam morland)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96356Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Webform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended to grant submission access only to selected user accounts could also grant access to anonymous users.

This vulnerability is mitigated by the fact that the bypass depends on malformed saved access-rule configuration.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Adam Bramley (acbramley)
• enyug

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Liam Morland (liam morland)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96398Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module did not sufficiently restrict access to certain submission view modes. Under certain conditions, a user who can view a submission could access a more permissive view mode and see fields that would otherwise be restricted.

This vulnerability is mitigated by the fact that an attacker must already have access to view the affected submission.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Mustafa Ahmed (mustafa007)

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Mustafa Ahmed (mustafa007)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96357Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files.

The module does not sufficiently force certain uploaded file types to download when served. Under certain site configurations, a file uploaded through a webform could be rendered inline by a browser, resulting in a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that a user with permission to create or edit webforms must configure the form to allow the affected file extensions, and a user must specifically open the uploaded file.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Michael Maturi (michaelmaturi)

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Lee Rowlands (larowlan) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Exploit/TD:UncommonVulnerability: Access bypassAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96364Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The Webform Share submodule can expose a webform for embedding on another site.

Under certain circumstances, submissions for an Ajax-enabled Webform using Webform Share can bypass anti-spam protections.

This vulnerability is mitigated by the fact that Webform Share must be enabled, sharing must be enabled for the affected webform, and the affected webform must rely on compatible Form-API-based anti-spam protections such as Honeypot or Antibot.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• karing

Fixed By: 

• Alan Dixon (adixon)
• Dan Chadwick (danchadwick)
• Jacob Rockowitz (jrockowitz)
• Liam Morland (liam morland)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Mori Sugimoto (dokumori) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Less critical 8 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:UncommonVulnerability: Denial of serviceAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96365Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Forms may be displayed in blocks.

Webform does not sufficiently validate an optional token query value before using it. Under specific configurations where a Webform is rendered for anonymous visitors, a malicious request can cause the request to consume significant resources leading to a Denial of Service.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Majdi Alomari (majdi)

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Liam Morland (liam morland)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96366Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments.

In affected configurations, Webform did not sufficiently validate a managed file upload element when processing a new submission. A user with access to submit a vulnerable webform could potentially access other managed files they were not authorized to view.

This vulnerability is mitigated by the fact that a site must have a Webform with a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own webform submissions or sending uploads as email attachments.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Sandro Kneubühl (blackpharao)
• omidsec

Fixed By: 

• Jacob Rockowitz (jrockowitz)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Heine Deelstra (heine) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Mohit Aghera (mohit_aghera) provisional member of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96373Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view submission results for one webform may be able to access or remove files from the configured export temporary directory that were not generated for that webform.

This vulnerability is mitigated by the fact that an attacker must have access to view submission results for a webform and must know or be able to determine a target filename.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Jacob Rockowitz (jrockowitz)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96372Description: 

The Webform module enables site builders to create forms and collect submissions.

The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation.

The update adds the Administer webform remote post URLs permission. Review this permission and ensure it is granted only to trusted roles.

The vulnerability is mitigated by the fact that an attacker must have a role with permission to edit a webform.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.11.

Review the new permission Administer webform remote post URLs and ensure it is only granted to trusted roles.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team
• Wesley Giles (seraphdev)

Fixed By: 

• Dan Chadwick (danchadwick)
• Jacob Rockowitz (jrockowitz)
• Liam Morland (liam morland)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96371Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module does not sufficiently restrict access to raw webform source editing when the Webform UI module is not enabled. This could allow a user with webform creation or editing permissions to enter source configuration that is rendered unsafely.

This vulnerability is mitigated by the fact that an attacker must have permission to create or edit webforms.

Solution: 

Install the latest version.

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Dan Chadwick (danchadwick)
• Jacob Rockowitz (jrockowitz)
• Lee Rowlands (larowlan) of the Drupal Security Team
• Liam Morland (liam morland)
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Less critical 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96369Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that authenticated users can view their own submissions, a request to the JSON:API webform submission collection can return a cached response generated for a different user.

This can allow an authenticated user to view another user's webform submission data through the JSON:API collection endpoint.

This vulnerability is mitigated by the fact that JSON:API must be enabled, the affected webform must expose submissions through JSON:API, and the attacker must have an account with permission to view their own submissions for the affected webform.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Giuseppe (giuseppe87)

Fixed By: 

• Damien McKenna (damienmckenna) of the Drupal Security Team
• Jacob Rockowitz (jrockowitz)
• Lee Rowlands (larowlan) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Jacob Rockowitz (jrockowitz)
• Juraj Nemec (poker10) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypass, Server-side request forgeryAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96370Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs.

The submodule did not sufficiently validate access to export/import functionality. A user who could edit webform submissions and access webform results could also access the import interface, including the remote URL import path, leading to a server-side request forgery vulnerability.

Sites that do not enable the Webform Submission Export/Import submodule are not affected.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

For sites that need remote imports, explicitly configure the trusted hosts in settings.php:

$settings['webform_submission_export_import_csv_hosts'] = ['staging.example.com']; $settings['webform_submission_export_import_file_hosts'] = ['files.staging.example.com', '*.google.com']; Reported By: 

• abdo.boutanos@richemont.com
• chulhan park (cjfgks1230)
• Abdulhakeem Onipede (kism37)
• Marcus Johansson (marcus_johansson)

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Marcus Johansson (marcus_johansson)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• cilefen (cilefen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96368Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may add tooltips and help text to these forms.

Some Webform tooltips and help text were not sufficiently sanitized, resulting in possible cross-site scripting (XSS).

This vulnerability is mitigated by the fact that an attacker must have permission to create or edit affected Webform configuration or content.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Jacob Rockowitz (jrockowitz)
• Lee Rowlands (larowlan) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WebformProject machine name: webformDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <6.2.12 || >=6.3.0 <6.3.1CVE IDs: CVE-2026-96367Description: 

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module does not sufficiently restrict access to the custom attributes YAML editor. Users with permission to create or edit webforms (but without permission to edit webform source) may be able to add custom attributes, leading to cross-site scripting.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit webforms.

Solution: 

Install the latest version:

• If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
• If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.

Reported By: 

• Mitch Portier (arkener)

Fixed By: 

• Dan Chadwick (danchadwick)
• Jacob Rockowitz (jrockowitz)
• Liam Morland (liam morland)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team