{"id":"CVE-2026-96360","kind":"vulnerability","aliases":["CVE-2026-96360"],"related":[],"title":"Drupal Webform: cross-site scripting flaw in form pages","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"The Drupal Webform module fails to neutralize some input when generating web pages, enabling cross-site scripting. An attacker who gets a crafted value into a page can run script in a visitor's browser, which may be a logged-in administrator.","severity":"low","cvss":3.5,"epss":0.00184,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["webform-not-installed"],"how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page.\n- Confirm whether the version is `6.2.12` or older, or `6.3.0` to `6.3.1`.","fix":"- Upgrade the Drupal Webform module to a release newer than `6.3.1` and newer than `6.2.12`, as listed in the Drupal security advisory.","status":"open","published_at":"2026-10-22T02:17:06+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:45:37+00:00","updated_at":"2026-10-25T04:45:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:45:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal Webform module to a release newer than `6.3.1` and newer than `6.2.12`, as listed in the Drupal security advisory.","reach":"internet","title":"Drupal Webform: cross-site scripting flaw in form pages","impact":"medium","summary":"The Drupal Webform module fails to neutralize some input when generating web pages, enabling cross-site scripting. An attacker who gets a crafted value into a page can run script in a visitor's browser, which may be a logged-in administrator.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in visitor browsers, possibly stealing admin sessions.","analyst_note":"Check the Drupal security advisory for the exact fixed versions and the vulnerable input path, and whether anonymous submission is needed.","how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page.\n- Confirm whether the version is `6.2.12` or older, or `6.3.0` to `6.3.1`.","needs_analyst":true,"not_affected_if":["webform-not-installed"],"who_is_affected":"Sites running the Drupal Webform module in the affected version ranges. The sources do not say which Webform features or input paths are involved, so exposure beyond the version range is unknown. Sites without Webform installed can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00061,"input_tokens":3368,"output_tokens":546,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96360':13A,16A '0.0.0':95C '6.2.12':97C '6.3.0':99C '6.3.1':101C 'administr':66B 'affect':91C 'allow':83C 'attack':42B 'browser':58B 'craft':46B 'cross':4A,38B,76C,85C 'cross-sit':3A,37B,75C,84C 'cve':11A,14A 'drupal':1A,17B,24B,81C 'enabl':36B 'fail':27B 'flaw':7A 'form':9A 'generat':33B,74C 'get':44B 'host':21B 'improp':67C 'input':31B,70C 'issu':90C 'log':64B 'logged-in':63B 'may':60B 'modul':26B 'neutral':29B,68C 'packag':18B 'page':10A,35B,50B,73C 'run':52B 'script':6A,40B,53B,78C,87C 'self':20B 'self-host':19B 'site':5A,39B,77C,86C 'valu':47B 'version':93C 'visitor':56B 'vulner':79C 'web':34B,72C 'webform':2A,22B,25B,82C,92C 'xss':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Webform module in the affected version ranges. The sources do not say which Webform features or input paths are involved, so exposure beyond the version range is unknown. Sites without Webform installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96360","severity":null,"published_at":"2026-10-22T02:17:06+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96360","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96360","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}