Webform Multiple File Upload CVE-2025-12848

Real-world exploitation risk is moderate-to-low based on converging signals. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms network-accessible, low-complexity attacks requiring no privileges but mandating user interaction. The EPSS score of 0.07% places this in the 21st percentile, indicating security researchers and threat actors assess exploitation probability as significantly below average. No public exploit identified at time of analysis further reduces immediate risk. The CVSS base score of 7.0 appears elevated relative to practical exploitability: successful attacks require victims to visit a page displaying the malicious filename AND the specific Webform configuration to have file type validation disabled, which is non-default. SSVC decision factors favor Defer priority: exploitation status is none, automation is possible but constrained by configuration requirements, and technical impact is limited to client-side XSS rather than server compromise. Organizations running Drupal 7.x with this module should prioritize patching during normal maintenance cycles rather than emergency response.

An unauthenticated attacker identifies a publicly accessible Webform node using the Webform Multiple File Upload module with file type validation disabled. The attacker uploads a file with a crafted filename such as '<img src=x onerror=alert(document.domain)>.jpg' through the multifile upload interface. When site administrators or other users view the webform submission listing page where uploaded filenames are displayed, the malicious JavaScript embedded in the filename executes in their browser context, enabling session hijacking, credential theft, or defacement attacks. The low attack complexity and network-accessible vector make this exploitable by unsophisticated attackers, though the requirement for user interaction and specific misconfiguration limits practical impact.