psf-drupal-webform-check(8)

Script: /opt/psf-security-patches/drupal/drupal-webform-check.sh. Tool page: Drupal. Source. With the package installed: man psf-drupal-webform-check.

Drupal Webform remote code execution: read-only checker  (v1)
CVE-2026-96355 (SA-CONTRIB-2026-175)

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

The Drupal Webform module does not sufficiently exclude certain format
templates from token replacement. An attacker can submit data that is then
evaluated as template code when a submission is rendered. Depending on site
configuration and enabled modules this can mean information disclosure,
stored cross-site scripting or remote code execution. Drupal Security Team
rating: Critical, 18/25.

  Affected: Webform before 6.2.12, and 6.3.0 before 6.3.1
  Fixed:    6.2.12 on the 6.2.x branch, 6.3.1 on the 6.3.x branch
  Condition (from the advisory): an affected webform must define a custom
  multiple-value item format that includes submission-value tokens. Some
  impacts also depend on other enabled modules. Drupal core is not affected.

Webform is among the most widely installed Drupal modules and sits on public
pages. The same releases close 19 other Webform advisories published on the
same day (numbered between SA-CONTRIB-2026-154 and 174).

This script is read-only. It reads the Webform version from composer.lock and
from the module's own webform.info.yml, and scans exported configuration for
webforms that use a custom multiple-value format.

Usage:
  ./drupal-webform-check.sh [command] [DIR ...]

  check (default)  scan DIR (default /var/www /srv /opt /home) for Webform.
                   Exit 0 = nothing affected, 1 = an affected version found.
  version          print the script version.

Configuration stored only in the database is not visible to a file scan. To
list webforms with a custom multiple-value format from the live site, run in
the Drupal root:
  drush config:list --prefix=webform.webform. --format=list | while read -r c; do
    drush config:get "$c" elements 2>/dev/null | grep -E "format_items.*custom" >/dev/null && echo "$c"; done
Containers: with no directory argument the check also copies the files it reads from running
docker and podman containers (SCAN_CONTAINERS=1, the default; 0 skips them) and judges them like
host installs. The copies are temporary: a path shown as .../docker_NAME_PATH is the PATH inside
the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.