Live › vulnerability › CVE-2026-96355
Go to dashboardDrupal Webform's template handling does not neutralize special elements, so input is treated as template code. An attacker who can reach the injection point can get code executed on the site server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed Webform version, e.g. composer show drupal/webform or the Webform module page in Drupal admin; versions 6.2.12 and earlier and 6.3.0 to 6.3.1 are affected.
Upgrade drupal/webform to a release newer than 6.3.1 (the fixed version is not named in the sources; check the Drupal security advisory).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96355")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.