Project:
Project machine name:
webformDate:
2026-September-23
Vulnerability:
Cross-site scripting
Affected versions:
<6.2.12 || >=6.3.0 <6.3.1
CVE IDs:
CVE-2026-96358
Description:
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a rating element.
This vulnerability is mitigated by the fact that an attacker must be able to place crafted HTML markup on the same page as a Webform rating element.
Solution:
Install the latest version:
- If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12.
- If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1.
Reported By:
- Pierre Rudloff (prudloff) of the Drupal Security Team
Fixed By:
- Jacob Rockowitz (jrockowitz)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
