{"id":"CVE-2026-96355","kind":"vulnerability","aliases":["CVE-2026-96355"],"related":[],"title":"Drupal Webform: template engine flaw lets attackers inject and run code","description":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"Drupal Webform's template handling does not neutralize special elements, so input is treated as template code. An attacker who can reach the injection point can get code executed on the site server.","severity":"critical","cvss":9.1,"epss":0.00427,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted","webform"],"not_affected_if":["webform-not-installed"],"how_to_check":"Check the installed Webform version, e.g. 'composer show drupal/webform' or the Webform module page in Drupal admin; versions 6.2.12 and earlier and 6.3.0 to 6.3.1 are affected.","fix":"Upgrade drupal/webform to a release newer than 6.3.1 (the fixed version is not named in the sources; check the Drupal security advisory).","status":"open","published_at":"2026-10-22T02:17:05+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:37+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:32:37Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade drupal/webform to a release newer than 6.3.1 (the fixed version is not named in the sources; check the Drupal security advisory).","reach":"internet","title":"Drupal Webform: template engine flaw lets attackers inject and run code","impact":"high","summary":"Drupal Webform's template handling does not neutralize special elements, so input is treated as template code. An attacker who can reach the injection point can get code executed on the site server.","category":"package","who_cares":["drupal","webform","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Code runs on the web server with the site's privileges","analyst_note":"Confirm the fixed Webform version and which injection point is exploitable (anonymous form submission or admin-only) at the NVD entry or the Drupal security advisory.","how_to_check":"Check the installed Webform version, e.g. 'composer show drupal/webform' or the Webform module page in Drupal admin; versions 6.2.12 and earlier and 6.3.0 to 6.3.1 are affected.","needs_analyst":true,"not_affected_if":["webform-not-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000509,"input_tokens":2911,"output_tokens":435,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-96355':14A,17A '0.0.0':81C '6.2.12':83C '6.3.0':85C '6.3.1':87C 'affect':77C 'allow':72C 'attack':7A,43B 'code':11A,41B,52B,73C 'cve':12A,15A 'drupal':1A,18B,25B,70C 'element':34B,62C 'engin':4A,67C 'execut':53B 'flaw':5A 'get':51B 'handl':29B 'host':23B 'improp':58C 'inject':8A,48B,74C 'input':36B 'issu':76C 'let':6A 'neutral':32B,59C 'packag':19B 'php':20B 'point':49B 'reach':46B 'run':10A 'self':22B 'self-host':21B 'server':57B 'site':56B 'special':33B,61C 'templat':3A,28B,40B,66C 'treat':38B 'use':63C 'version':79C 'vulner':68C 'webform':2A,24B,26B,71C,78C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96355","severity":null,"published_at":"2026-10-22T02:17:05+00:00","modified_at":"2026-10-23T04:18:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96355","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96355","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}