PatchClock

PHP security digest · 23 Sep 2026

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform...

Unrated CVE-2026-96370

Package
drupal/webform
Fixed in
6.2.12, 6.3.1
Published
Wed 23 Sep 2026, 17:16 LisbonUpdated Mon 26 Oct 2026, 02:27 Lisbon

In plain words

A user who can edit webform submissions and access webform results could also access the import interface because access checks were insufficient. This includes importing from remote URLs, allowing server-side request forgery. Sites without the Webform Submission Export/Import submodule enabled are not affected.

Am I affected?

Look for drupal/webform and its version in composer.lock. The advisory lists fixes in 6.2.12 and 6.3.1, but gives no affected version range. Check whether the Webform Submission Export/Import submodule is enabled and whether users can both edit webform submissions and access webform results.

What to do

Check which version you have, then update to a fixed release for your branch (6.2.12, 6.3.1):

composer show drupal/webform | grep versions
composer update drupal/webform

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

Sites that do not enable the Webform Submission Export/Import submodule are not affected.

The advisory's description

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs.

The submodule did not sufficiently validate access to export/import functionality. A user who could edit webform submissions and access webform results could also access the import interface, including the remote URL import path, leading to a server-side request forgery vulnerability.

Sites that do not enable the Webform Submission Export/Import submodule are not affected.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.