EUVD-2026-107845
GHSA-wmg8-83xq-9c4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as privileged Webform user
-
DeliveryInject script into webform config/element
-
ExploitVictim views affected page
-
ExecutionScript executes in victim browser
-
ImpactLimited session data or action abuse
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated actor holding high Webform privileges (PR:H - typically permission to create or configure webforms) to store malicious script, plus a second user who interacts with the affected page (UI:R) for the payload to fire; this is not remote-unauthenticated. The specific element, field, or configuration setting that carries the injection is not described in the available sources. Limiting factors that reduce real-world risk: the required elevated/trusted privilege level, the mandatory victim interaction, and the unchanged scope (S:U) confining impact to the vulnerable application context. Affected deployments are Drupal sites running the Webform module at versions up to 6.2.12 or 6.3.0-6.3.1. |
| Impact | This is a low-severity, low-priority issue and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 3.5 (Low) with vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N, meaning exploitation requires a high-privileged authenticated account (PR:H) plus victim interaction (UI:R), with only limited confidentiality and integrity impact and no availability impact - characteristic of a constrained XSS reachable by trusted/administrative users. EPSS is very low (0.17%, 6th percentile), the CVE is NOT listed in CISA KEV, and the vuln.today Decision label is 'monitor', all of which agree with the low CVSS. No PoC or working exploit code is indicated in the input: the references are vendor/aggregator advisories (Drupal SA-contrib-2026-154, VulDB 425140, NVD/EUVD), not exploit code. There is no conflict between network attack vector and the description here - XSS is delivered over the web but still gated behind PR:H and UI:R. Bottom line: a genuine but low-urgency defect; patch in the normal maintenance cycle rather than as an emergency. |
| Exploit ScenarioDerived | A user who already holds elevated Webform permissions (PR:H) injects a malicious script into a Webform element or configuration; when another user with sufficient access views the affected form or submission (UI:R), the script executes in their browser session, enabling limited data disclosure or action-on-behalf. No public exploit code is identified at time of analysis, and the precise injectable field is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Script injection in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets an actor who already holds high Webform privileges place malicious script that executes in another user's browser when that user interacts with the affected page. The injection point is a webform element or configuration setting that the available sources do not identify, and successful exploitation requires both the elevated privilege and victim interaction, keeping confidentiality and integrity impact low and scope unchanged. This is a low-severity issue: EPSS is 0.17% (6th percentile), it is not in CISA KEV, no public exploit code is confirmed, and the vendor has published a patch; the current priority decision is monitor.
RemediationAI
Patch available per vendor advisory: the Drupal security team has released a fix, and the exact patched release numbers for both the 6.2.x and 6.3.x branches are listed in SA-CONTRIB-2026-154 at https://www.drupal.org/sa-contrib-2026-154, which is the authoritative source to follow when selecting an upgrade target for each affected range (0.0.0-6.2.12 and 6.3.0-6.3.1). Sites that cannot update immediately retain only the inherent limiting factors described in this analysis rather than a documented workaround: exploitation requires an authenticated account with high Webform privileges such as the ability to create or configure webforms, plus a second user who interacts with the affected page, so exposure is concentrated among sites where those configuration permissions are broadly granted and no alternate mitigation procedure is described in the available sources. Confirm the deployed Webform version through Drupal's available-updates report before and after upgrading, since the module ships independently of Drupal core. Given EPSS of 0.17% (6th percentile), no KEV listing, and no confirmed public exploit code, this is tracked as monitor priority, but the update should still be scheduled as part of routine contributed-module maintenance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), i.e. classic cross-site scripting in the Drupal Webform contrib module, which is identified by CPE cpe:2.3:a:drupal:webform. Drupal renders contributed-module output through its theme and render-array pipeline, and CWE-79 in that context means attacker-supplied markup reaches a page without adequate escaping, so it is interpreted as script in the browser of whoever views the page rather than as inert text. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N describes a network-reachable flaw that requires high privileges (PR:H - typically permission to create or configure webforms) and a separate user who interacts with the crafted content (UI:R); that vector describes severity and preconditions only, and the specific element, field or configuration setting that carries the injection is not described in the available sources. Scope is unchanged (S:U), so any script execution is confined to the Drupal application's own origin. The affected code base is the Webform module itself as shipped for Drupal, tracked in ENISA EUVD as EUVD-2026-107845.
Know when Webform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Web-delivered XSS reachable only by a high-privileged Webform user (PR:H) and requiring victim interaction (UI:R), with limited C/I and no availability or scope change.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB