Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-96355: Drupal Webform lets attackers run code remotely
CVE-2026-96355 · published 11 days ago
Summary
Versions of the Drupal Webform module up to 6.2.12 and 6.3.1 let a specially crafted form input execute code on the server. This could let an attacker take control of your website or access data. Update the Webform module to the newest release or apply the vendor's patch as soon as possible.
What to do
- Update drupal drupal/webform to version 6.3.1.
- Update drupal webform to version 6.2.12 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Packagist:https://packages.drupal.org/8 | drupal | drupal/webform |
>= 6.3.0, < 6.3.1 Fix: upgrade to 6.3.1
|
| – | drupal | webform | < 6.2.12 |
Original advisory text
Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
References
- https://www.drupal.org/sa-contrib-2026-175 URL
- https://git.drupalcode.org/project/webform URL
- https://www.drupal.org/project/webform URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96355... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-96355 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published22 Oct 2026
Updated30 Oct 2026
First seen23 Sep 2026
Sources
DRUPAL-CONTRIB-2026-175 · OSV
CVE-2026-96355 · NVD
CVE-2026-96355 · MITRE
CVE-2026-96355 · OSV
Track software like this
Free during beta