The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configu...

A user who can submit a vulnerable Webform could potentially access other managed files they are not authorised to view. This requires a form with a managed file upload element and a configuration that exposes submitted files, such as letting users view their own submissions or sending uploads as email attachments.

Look for drupal/webform and its version in composer.lock. The advisory lists fixes in 6.2.12 and 6.3.1 but gives no affected version range. Check whether any Webform has a managed file upload element and exposes submitted files, for example through access to users’ own submissions or email handlers that attach uploads. The user must also have access to submit that form.

Limit exposure by avoiding the combination of a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own submissions or sending uploads as email attachments.

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments.

In affected configurations, Webform did not sufficiently validate a managed file upload element when processing a new submission. A user with access to submit a vulnerable webform could potentially access other managed files they were not authorized to view.

This vulnerability is mitigated by the fact that a site must have a Webform with a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own webform submissions or sending uploads as email attachments.