---
id: "CVE-2026-96368"
kind: "vulnerability"
aliases: ["CVE-2026-96368"]
title: "Drupal Webform: stored cross-site scripting via form input"
severity: "medium"
cvss: 4.6
epss: 0.00226
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted", "webform"]
not_affected_if: ["patched-version", "webform-not-installed"]
published_at: "2026-10-22T02:17:07+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:35:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96368", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96368", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Drupal Webform: stored cross-site scripting via form input

The Drupal Webform module fails to neutralize input when generating pages, so stored script can be saved and run in other users' browsers. An attacker who can submit or store that input can run script in a victim's session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Webform module version in the Drupal project (for example `drush pm:list --filter=webform`) and compare it against the affected range.
- Confirm whether the site is running a Webform version from `6.2.12` or earlier, or `6.3.0` to `6.3.1`.

## Fix

- Upgrade the Drupal Webform module to a version newer than `6.3.1` and newer than `6.2.12`; the exact fixed version is unknown from the sources.
- Review the Drupal security advisory for the patched release before deploying.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96368
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96368

## From the sources

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_