The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. Webform does not sufficientl...

An attacker may submit data that is evaluated as template code when a Webform submission is rendered. This requires a webform configured with a custom multiple-value item format containing submission-value tokens. Depending on the site configuration and enabled modules, this could expose information, cause stored cross-site scripting, or allow remote code execution.

Look for drupal/webform and its version in composer.lock. The advisory lists fixes in 6.2.12 and 6.3.1 but gives no affected version range. Check whether any webform uses a custom multiple-value item format containing submission-value tokens. Additional enabled modules and site-specific configuration may affect the impact.

The vulnerability is mitigated by requiring an affected webform to use a custom multiple-value item format that includes submission-value tokens. Some impacts also depend on additional enabled modules or site-specific configuration.

The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.

Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code when a submission is rendered. Depending on the site configuration and enabled modules, this may lead to information disclosure, stored cross-site scripting, or remote code execution.

This vulnerability is mitigated by the fact that an affected webform must be configured with a custom multiple-value item format that includes submission-value tokens. Some impacts may also depend on additional enabled modules or site-specific configuration.