critical
advisory
Drupal Webform: Code injection via template engine (CVE-2026-96355)
The Drupal Webform module is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability, which allows for Code Injection.
CVE search metadata
CVE search record: CVE-2026-96355. Severity: critical. CVSS: 9.1. KEV: no. Product: Webform (0.0.0-6.2.12, 6.3.0-6.3.1). Brief: Drupal Webform: Code injection via template engine (CVE-2026-96355). Brief link: https://feed.craftedsignal.io/briefs/2026-10-drupal-webform-code-injection/
Triage facts
Revision 1- Applicability
- Webform (0.0.0-6.2.12, 6.3.0-6.3.1)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 16:14 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Drupal Webform is affected by a vulnerability identified as CVE-2026-96355. This issue involves the improper neutralization of special elements within the module's template engine, resulting in Code Injection. This vulnerability affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.