CVE-2026-96355

Summary

The Drupal Webform module before 6.2.13 and 6.3.2 contains a code injection flaw (CWE-1336) where unsanitized user input in templates can execute arbitrary server-side code, leading to full compromise of confidentiality and integrity.

Exploitability

Exploitation is straightforward for remote attackers with access to the Webform module's template features; no authentication or user interaction is required.

Blast radius

Successful exploitation allows attackers to read sensitive data and modify system files or application logic, potentially affecting all sites running vulnerable Webform versions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Webform version 6.2.13 or 6.3.2 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.