Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-164 (CVE-2026-96370)

    Vulnerability from drupal – Published: 2026-09-23 16:16 – Updated: 2026-09-23 16:46 – Source website
    VLAI
    Details

    The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

    The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs.

    The submodule did not sufficiently validate access to export/import functionality. A user who could edit webform submissions and access webform results could also access the import interface, including the remote URL import path, leading to a server-side request forgery vulnerability.

    Sites that do not enable the Webform Submission Export/Import submodule are not affected.

    Credits
    Abdulhakeem Onipede (kism37) www.drupal.org/u/kism37
    Marcus Johansson (marcus_johansson) www.drupal.org/u/marcus_johansson
    abdo.boutanos@richemont.com www.drupal.org/u/abdoboutanosrichemontcom
    chulhan park (cjfgks1230) www.drupal.org/u/cjfgks1230
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c6.2.12 || \u003e=6.3.0 \u003c6.3.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/webform"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c6.2.12"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.12"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=6.3.0 \u003c6.3.1"
          },
          "events": [
            {
              "introduced": "6.3.0"
            },
            {
              "fixed": "6.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96370"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/kism37"
      ],
      "name": "Abdulhakeem Onipede (kism37)"
    },
    {
      "contact": [
        "https://www.drupal.org/u/marcus_johansson"
      ],
      "name": "Marcus Johansson (marcus_johansson)"
    },
    {
      "contact": [
        "https://www.drupal.org/u/abdoboutanosrichemontcom"
      ],
      "name": "abdo.boutanos@richemont.com"
    },
    {
      "contact": [
        "https://www.drupal.org/u/cjfgks1230"
      ],
      "name": "chulhan park (cjfgks1230)"
    }
  ],
  "details": "The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.\n\nThe module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs.\n\nThe submodule did not sufficiently validate access to export/import functionality. A user who could edit webform submissions and access webform results could also access the import interface, including the remote URL import path, leading to a server-side request forgery vulnerability.\n\nSites that do not enable the Webform Submission Export/Import submodule are not affected.",
  "id": "DRUPAL-CONTRIB-2026-164",
  "modified": "2026-09-23T16:46:08.000Z",
  "published": "2026-09-23T16:16:35.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-164"
    }
  ],
  "schema_version": "1.7.0"
}