---
id: "CVE-2026-96355"
kind: "vulnerability"
aliases: ["CVE-2026-96355"]
title: "Drupal Webform: template engine flaw lets attackers inject and run code"
severity: "critical"
cvss: 9.1
epss: 0.00427
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted", "webform"]
not_affected_if: ["webform-not-installed"]
published_at: "2026-10-22T02:17:05+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96355", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96355", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Drupal Webform: template engine flaw lets attackers inject and run code

Drupal Webform's template handling does not neutralize special elements, so input is treated as template code. An attacker who can reach the injection point can get code executed on the site server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed Webform version, e.g. 'composer show drupal/webform' or the Webform module page in Drupal admin; versions 6.2.12 and earlier and 6.3.0 to 6.3.1 are affected.

## Fix

Upgrade drupal/webform to a release newer than 6.3.1 (the fixed version is not named in the sources; check the Drupal security advisory).

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96355
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96355

## From the sources

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_