cve.nowby Sazabi
← All vulnerabilities
CVE-2026-96355DRUPAL-CONTRIB-2026-175EUVD-2026-107826GHSA-4CXR-J7H5-H594

Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 6.2.12, 6.3.1
Public exploit
None on Exploit-DB

Summary

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected versions

  • Drupal Webform

    From 0.0.0 · fixed in 6.2.12; From 6.3.0 · fixed in 6.3.1

  • drupal/webformPackagist

    fixed in 6.2.12; From 6.3.0 · fixed in 6.3.1

References 1

drupal.org