Drupal Webform: Code injection in template engine
Summary
The contributed Drupal module Webform, used for forms and submission handling, contains a template engine injection flaw (CWE-1336). Drupal's advisory states that it is mitigated unless a form uses a custom multiple-value item format that includes submission-value tokens. Depending on the site configuration and enabled modules, an attacker who can submit data may be able to cause information disclosure, stored cross-site scripting or remote code execution. The CVSS 9.1 score in the ticket is not yet confirmed by NVD.
Affected
- Webform versions from 0.0.0 to before 6.2.12
- Webform versions from 6.3.0 to before 6.3.1
- Only sites with a custom multiple-value item format that uses submission-value tokens are affected, according to the vendor advisory
Fixed in
- 6.2.12 for the 6.2.x branch
- 6.3.1 for the 6.3.x branch
- Upgrade to the newest release, as both releases belong to a set of 22 coordinated security fixes
Workaround
- No vendor workaround published.
- Non-vendor suggestion: review forms for custom multiple-value formats with submission tokens and remove them where not needed until the upgrade is done.
- Sites on branches older than 6.1 are not supported and must move to a supported branch.
Exploitation
- Drupal rates exploitation as Theoretical.
- Feedly reports no confirmed exploitation in the wild.
- No CISA KEV entry and no public proof of concept found as of research. This is not confirmed absence.
Our recommendation
- Check the installed Webform version and upgrade to 6.2.12 or 6.3.1 as appropriate, applying the full Drupal release set.
- Review forms with custom multiple-value formats that use submission tokens.
- Recheck NVD for the official score and any KEV change.
- Also patch the related Webform issues SA-CONTRIB-2026-174 and SA-CONTRIB-2026-164 in the same update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Drupal Security Advisory SA-CONTRIB-2026-175 www.drupal.org
- Webform 6.3.1 release www.drupal.org
- Webform 6.2.12 tag git.drupalcode.org
- OSV DRUPAL-CONTRIB-2026-175 osv.dev
- VulDB CVE-2026-96355 vuldb.com
- Feedly CVE-2026-96355 feedly.com
- Strix CVE-2026-96355 www.strix.ai
- Drupal Security Advisory SA-CONTRIB-2026-174 www.drupal.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:32.
Original description (NVD)
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.