Drupal Webform EUVD-2026-107835

Exploitation requires an authenticated Drupal account with a Webform-related permission that allows injecting content which Webform stores and later renders (the CWE-267 'privilege defined with unsafe actions' root cause) - i.e. a role granted webform submit/create or configuration capability. The attack is Stored XSS, so a second user (typically an administrator or reviewer) must subsequently view the stored content for the payload to execute; this victim-view requirement and the required low-privilege authentication (PR:L) are the primary limiting factors. It affects Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1; sites on the fixed releases are not exposed. The available sources do not identify which specific Webform field or permission carries the unsafe action, so the exact vulnerable feature should be confirmed against the Drupal advisory.

This is a moderate-severity, low-priority issue and the signals are largely consistent in pointing away from urgent, widespread risk. The CVSS 3.1 base score is 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - network-reachable and low-complexity, but requiring an already-authenticated low-privileged account (PR:L), which materially constrains who can exploit it. The CWE-267 (Privilege Defined With Unsafe Actions) classification indicates the root cause is that a role/permission in Webform is allowed to perform an action (injecting markup that is later stored and rendered) that it should not, resulting in Stored XSS. EPSS is very low at 0.18% (7th percentile), and the vulnerability is NOT on the CISA KEV list, so there is no evidence of active exploitation. No public exploit code is identified in the input - the two references are a Drupal security advisory and the NVD detail page, not proof-of-concept exploit code. The vuln.today decision label is 'this_month', i.e. routine patching rather than emergency. Net: this is a real but modest issue appropriately handled on a normal patch cadence, not a high-CVSS-but-overrated emergency and not a drop-everything priority. One caveat to verify with the vendor: the input vector lists S:U (scope unchanged), yet Stored XSS typically executes script in a different security context (a victim/admin browser session), which many analysts would score as S:C - this disagreement affects the headline score but not the overall low real-world urgency.

An attacker who holds a low-privileged Drupal account with permission to submit or configure Webform content injects a malicious script payload into a field that Webform stores and later renders without adequate sanitization. When a site administrator or other user views the stored submission or configuration, the script executes in their browser session, enabling session/cookie theft or actions in their context. No public exploit code was identified in the provided data, and exploitation first requires an authenticated low-privileged account (PR:L).