{"id":"CVE-2026-96368","kind":"vulnerability","aliases":["CVE-2026-96368"],"related":[],"title":"Drupal Webform: stored cross-site scripting via form input","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"The Drupal Webform module fails to neutralize input when generating pages, so stored script can be saved and run in other users' browsers. An attacker who can submit or store that input can run script in a victim's session.","severity":"medium","cvss":4.6,"epss":0.00226,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted","webform"],"not_affected_if":["patched-version","webform-not-installed"],"how_to_check":"- Check the installed Webform module version in the Drupal project (for example `drush pm:list --filter=webform`) and compare it against the affected range.\n- Confirm whether the site is running a Webform version from `6.2.12` or earlier, or `6.3.0` to `6.3.1`.","fix":"- Upgrade the Drupal Webform module to a version newer than `6.3.1` and newer than `6.2.12`; the exact fixed version is unknown from the sources.\n- Review the Drupal security advisory for the patched release before deploying.","status":"open","published_at":"2026-10-22T02:17:07+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:35:23+00:00","updated_at":"2026-10-25T04:35:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:35:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal Webform module to a version newer than `6.3.1` and newer than `6.2.12`; the exact fixed version is unknown from the sources.\n- Review the Drupal security advisory for the patched release before deploying.","reach":"internet","title":"Drupal Webform: stored cross-site scripting via form input","impact":"medium","summary":"The Drupal Webform module fails to neutralize input when generating pages, so stored script can be saved and run in other users' browsers. An attacker who can submit or store that input can run script in a victim's session.","category":"package","nicknames":[],"who_cares":["drupal","webform","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in victims' browsers, stealing sessions or data","analyst_note":"Confirm the fixed Webform version and whether submission by anonymous users is required, via the Drupal security advisory for this CVE.","how_to_check":"- Check the installed Webform module version in the Drupal project (for example `drush pm:list --filter=webform`) and compare it against the affected range.\n- Confirm whether the site is running a Webform version from `6.2.12` or earlier, or `6.3.0` to `6.3.1`.","needs_analyst":true,"not_affected_if":["webform-not-installed","patched-version"],"who_is_affected":"Sites running the Drupal Webform module in the affected version ranges are exposed, most of all those where untrusted users can submit forms or where stored form content is displayed to other users or administrators. Sites without the Webform module, or on patched versions, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000632,"input_tokens":3361,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96368':13A,16A '0.0.0':89C '6.2.12':91C '6.3.0':93C '6.3.1':95C 'affect':85C 'allow':80C 'attack':48B 'browser':46B 'cross':5A,73C 'cross-sit':4A,72C 'cve':11A,14A 'drupal':1A,17B,25B,78C 'fail':28B 'form':9A 'generat':33B,71C 'host':22B 'improp':64C 'input':10A,31B,55B,67C 'issu':84C 'modul':27B 'neutral':30B,65C 'packag':18B 'page':34B,70C 'php':19B 'run':42B,57B 'save':40B 'script':7A,37B,58B,75C 'self':21B 'self-host':20B 'session':63B 'site':6A,74C 'store':3A,36B,53B,81C 'submit':51B 'user':45B 'version':87C 'via':8A 'victim':61B 'vulner':76C 'web':69C 'webform':2A,23B,26B,79C,86C 'xss':82C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Webform module in the affected version ranges are exposed, most of all those where untrusted users can submit forms or where stored form content is displayed to other users or administrators. Sites without the Webform module, or on patched versions, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96368","severity":null,"published_at":"2026-10-22T02:17:07+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96368","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96368","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}