PatchClock

PHP security digest · 23 Sep 2026

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficient...

Unrated CVE-2026-96373

Package
drupal/webform
Fixed in
6.2.12, 6.3.1
Published
Wed 23 Sep 2026, 17:20 LisbonUpdated Mon 26 Oct 2026, 02:27 Lisbon

In plain words

Webform does not sufficiently validate filenames when serving generated submission exports. Under certain configurations, a user allowed to view one webform's submission results may be able to access or remove files in the configured export temporary directory that were not generated for that webform. They must also know or be able to determine the target filename.

Am I affected?

Find drupal/webform and its version in composer.lock. The advisory lists fixes in 6.2.12 and 6.3.1 but gives no affected version range. Review submission export configuration, the configured export temporary directory and who has permission to view submission results. The advisory does not specify which configurations are vulnerable.

What to do

Check which version you have, then update to a fixed release for your branch (6.2.12, 6.3.1):

composer show drupal/webform | grep versions
composer update drupal/webform

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The advisory identifies two mitigating requirements: an attacker must have access to view submission results for a webform and must know or be able to determine a target filename.

The advisory's description

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view submission results for one webform may be able to access or remove files from the configured export temporary directory that were not generated for that webform.

This vulnerability is mitigated by the fact that an attacker must have access to view submission results for a webform and must know or be able to determine a target filename.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.