Webform Can Turn Stored Data Into Executable Logic
A Webform display rule can treat saved responses as template instructions, not data. The failure occurs during rendering, not necessarily on submission.
CVE-2026-96355 concerns this contributed Drupal component, not core. Exposure requires a custom multiple-value item format containing submission-value tokens. Other installed modules and configuration influence the impact.
Incomplete template exclusion during token processing can let submitted input become executable logic. Possible outcomes are leaked information, persistent browser-script injection and server execution. The advisory rates severity Critical, 18/25, and exploit availability Theoretical; it does not establish an observed attack or a demonstrated public exploit.
Inspect the display configuration, then verify the repair
Use 6.2.12 or 6.3.1 according to your supported branch. Releases below the former, and 6.3.0, are affected. The bulletin provides no separate workaround.
Record the installed package and inspect the exact custom display formats. A product inventory cannot show whether a particular form uses the affected configuration. Trace where saved responses are viewed, exported or emailed, including administrative workflows, and retain that evidence with the change record.
After updating, clear required caches and verify the package actually serving requests. Test expected form behaviour rather than accepting a deployment job as proof of the running state. Review relevant privileged changes to modules, themes and form settings as operational evidence, not as proof of exploitation.
The same release set contains separate module issues with different prerequisites. Repairing this rendering flaw does not demonstrate that those other issues are fixed.
Sources
- Security bulletin, dated 23 September 2026 without a publication time, rechecked 20 October.
- Contributed-project index, independently checked for its overlapping entry and distinct-issue context.
