PatchClock

PHP security digest · 23 Sep 2026

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include up...

Unrated CVE-2026-96357

Package
drupal/webform
Fixed in
6.2.12, 6.3.1
Published
Wed 23 Sep 2026, 17:26 LisbonUpdated Mon 26 Oct 2026, 01:27 Lisbon

In plain words

A file uploaded through a webform could be displayed directly in a browser instead of being forced to download, allowing cross-site scripting. This depends on the site configuration: the form must allow an affected file extension, and someone must specifically open the uploaded file.

Am I affected?

Find drupal/webform and its version in composer.lock. The listed fixed versions are 6.2.12 and 6.3.1; no affected version range is supplied. Review webform upload settings to see whether affected file extensions are allowed, although the advisory does not identify those extensions. Exploitation also requires someone to specifically open the uploaded file.

What to do

Check which version you have, then update to a fixed release for your branch (6.2.12, 6.3.1):

composer show drupal/webform | grep versions
composer update drupal/webform

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The advisory states that exploitation is mitigated by requiring a user with permission to create or edit webforms to configure the form to allow the affected file extensions, and requiring a user to specifically open the uploaded file.

The advisory's description

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files.

The module does not sufficiently force certain uploaded file types to download when served. Under certain site configurations, a file uploaded through a webform could be rendered inline by a browser, resulting in a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that a user with permission to create or edit webforms must configure the form to allow the affected file extensions, and a user must specifically open the uploaded file.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.