Skip to content
Heist/ feed
UnratedFix available

DRUPAL-CONTRIB-2026-172

Type: advisorySource: OSV1 source record

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files. The module does not sufficiently force certain uploaded file types to download when served. Under certain site configurations, a file uploaded through a webform could be rendered inline by a browser, resulting in a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that a user with permission to create or edit webforms must configure the form to allow the affected file extensions, and a user must specifically open the uploaded file.

Announced Source revision 1
Original source ↗

DRUPAL-CONTRIB-2026-172

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DRUPAL-CONTRIB-2026-172

drupal/webform

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
6.2.12

Source reference: /affected/0/ranges

6.3.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "6.2.12"
          }
        ],
        "database_specific": {
          "constraint": "<6.2.12"
        }
      },
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "6.3.0"
          },
          {
            "fixed": "6.3.1"
          }
        ],
        "database_specific": {
          "constraint": ">=6.3.0 <6.3.1"
        }
      }
    ],
    "package": {
      "name": "drupal/webform",
      "purl": "pkg:composer/drupal/webform?repository_url=https:%2F%2Fpackages.drupal.org%2F8",
      "ecosystem": "Packagist:https://packages.drupal.org/8"
    },
    "database_specific": {
      "source": "https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/webform/DRUPAL-CONTRIB-2026-172.json",
      "affected_versions": "<6.2.12 || >=6.3.0 <6.3.1"
    }
  }
]
Related CVEs
CVE-2026-96357

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Event
#46216 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement