CVE-2026-96371 in Webform
Summary
by MITRE • 10/23/2026
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The identified vulnerability represents a critical security flaw within the Drupal Webform module, specifically affecting version ranges spanning from early development releases up through 6.2.12 and 6.3.0 to 6.3.1. This issue is classified under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting or XSS. The root cause lies in the improper handling of user-supplied input within the form processing logic, where data entered by users is not adequately sanitized before being rendered back to other users' browsers. This failure allows an attacker to inject malicious client-side scripts into web pages viewed by other users, leading to a Stored Cross-Site Scripting attack vector rather than a reflected one.
In operational terms, this vulnerability enables persistent compromise of the application's integrity and user confidentiality. Because the injected script is stored on the server side within the form data itself, it executes automatically whenever an administrator or another user views the submitted form entry. This persistence distinguishes it from temporary session-based attacks and significantly increases the attack surface. An attacker can craft a malicious submission containing JavaScript code that steals session cookies, hijacks administrative sessions, performs actions on behalf of authenticated users without their consent, or redirects victims to phishing sites. The impact is particularly severe in environments where Webform modules are used for collecting sensitive data or managing user interactions, as the compromise extends beyond the initial submitter to all subsequent viewers of that specific form submission.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers JavaScript execution in web browsers. The attack chain typically involves an adversary crafting a specially designed HTML or script payload within the Webform fields and submitting it to the server. Once stored, the malicious content becomes part of the application's dynamic response. When another user accesses this data through their browser, the code executes in the context of the vulnerable site, bypassing same-origin policy restrictions due to the trusted nature of the domain. This allows for credential harvesting, keylogging, or further exploitation of connected backend systems if session tokens are exfiltrated.
Mitigation strategies must prioritize immediate remediation by upgrading the Drupal Webform module to a version that resolves this input validation flaw. For organizations unable to upgrade immediately due to compatibility constraints with legacy systems, compensating controls should be implemented at the web application firewall level to detect and block payloads containing common script injection patterns such as script tags, event handlers like onerror or onload, and javascript URIs. Additionally, developers must ensure that all user inputs are strictly validated against a whitelist of allowed characters and that output encoding is applied consistently across all rendering contexts within the module. Regular security audits focusing on form handling logic and input sanitization practices are essential to prevent similar vulnerabilities in future development cycles.