Nothing says "trust me with your data" like a contact form that can be tricked into running whatever code a stranger feels like writing. That's the situation Drupal site owners running Webform woke up to this week, and it's a good reminder that the scariest module on your site is usually the one everyone forgot to think about.
36 Advisories, One Very Bad One
On September 23, the Drupal Security Team dropped 36 advisories covering 16 contributed projects in a single coordinated release, with 20 of them hitting Webform alone. The headline item is SA-CONTRIB-2026-175 (CVE-2026-96355), rated Critical at 18/25: Webform fails to properly exclude certain format templates from token replacement, so an attacker can submit data that gets evaluated as template code when the submission renders.
Depending on your site's configuration, that can mean information disclosure, stored cross-site scripting, or full remote code execution. It affects Webform versions before 6.2.12, and 6.3.0 up to but not including 6.3.1 — the fix requires a custom multiple-value item format using submission-value tokens, so not every site is exposed, but plenty are.
Why "It Probably Doesn't Affect Me" Is a Trap
Here's the thing about Webform: it's on an enormous share of Drupal sites precisely because it's flexible enough to build almost anything, from a simple newsletter signup to a multi-page application form with conditional logic. That flexibility is exactly what makes the attack surface hard to reason about from the outside — you don't know if you're exposed until you actually check your configuration.
Drupal core wasn't touched here, which is worth noting because it means the "run updates and you're safe" instinct doesn't fully apply. Contributed modules are their own universe of risk, and a site that's meticulously patched on core while running six-month-old contrib modules is still very much a target.
Patch Webform today, audit your other contrib modules while you're in there, and maybe stop treating your forms folder like a drawer you never clean out.
If your Drupal site has more third-party modules than anyone on your team can currently name, that's exactly the kind of audit the WTK team does for a living — let's talk before an attacker does the inventory for you.
Source: The Droptimes