Drupal Webform CVE-2026-96355

The flaw is an improper neutralization of special elements in Webform's template engine (CWE-1336, server-side template injection) affecting Webform 0.0.0-6.2.11 and 6.3.0; it is fixed in 6.2.12 and 6.3.1, so running any version below those within the affected ranges is the primary precondition. The specific feature, input field, or configuration mode that evaluates attacker-controlled template syntax is not described in the available sources, so the exact entry point cannot be stated with certainty. The vendor CVSS implies no authentication or user interaction (PR:N/UI:N), but SSTI in Drupal Webform commonly requires permission to author webform elements or tokens - this limiting factor (a privileged authoring capability) is plausible but unverified here and should be confirmed with the vendor. Upgrading to a fixed version is the remediation the advisory provides.

Signals diverge sharply. The vendor CVSS of 9.1 with vector AV:N/AC:L/PR:N/UI:N describes a network-reachable, low-complexity, unauthenticated code-injection flaw (CWE-1336, server-side template injection) with high confidentiality and integrity impact - on paper a critical-priority issue, consistent with the vuln.today 'act_now' decision label and the vendor advisory (Drupal SA-contrib-2026-175). However, the exploitation-likelihood signals are weak: EPSS is only 0.22% (12th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code is identified in the provided sources (only vendor/aggregator advisories at vuldb and drupal.org). This combination suggests high theoretical severity but, as of this analysis, no evidence of widespread or active exploitation - the 'act_now' urgency is driven by the critical severity class and patch availability on a very popular module, not by observed attacks. Two signal conflicts should be verified with the vendor: (1) the vendor vector sets A:N, which is unusual for a code-injection/RCE-class flaw where arbitrary code execution would normally imply availability impact; and (2) PR:N (unauthenticated) conflicts with the common pattern for SSTI in Drupal Webform, where injecting Twig typically requires permission to author webform elements/templates - the actual trigger is not described in the available sources, so the true privilege requirement is unverified.

A remote attacker reaches a Drupal site running a vulnerable Webform module (0.0.0-6.2.11 or 6.3.0) and supplies specially crafted template (Twig) syntax into a Webform input or configuration element that the engine evaluates, causing server-side code injection with high confidentiality and integrity impact. The exact feature and whether authentication is required are not described in the available sources. No public exploit code is identified at time of analysis; only vendor and aggregator advisories are referenced.