External risk intelligence

Drupal Webform Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-96355

This vulnerability affects the Drupal Webform module, which is commonly installed and used on public-facing Drupal websites to handle user-submitted forms. Because Webform is designed to process external user input on web-accessible sites, the vulnerable component is frequently exposed to the public internet.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Drupal Webform module that could allow for code injection. This issue impacts specific versions of the Webform module and, if exploited, could potentially compromise the integrity and confidentiality of systems processing user-submitted data. The primary concern at this time is to confirm whether this module and its affected versions are in use within your organization.

Allows code injection via web forms.
Crucial to verify if this specific module is used.
Assess exposure; address if confirmed in use.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by submitting specially crafted input to a Drupal website using the vulnerable Webform module. This malicious input would be processed by the template engine within the Webform module, leading to code injection. Successful exploitation could allow an attacker to execute arbitrary code on the server.

No authentication required.
Submit malicious input to a webform.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the server. This could occur when the Drupal Webform module is used to process user-submitted data, potentially leading to unauthorized access or modification of system resources.

Server-side code execution.
Via crafted user input to Webform.
Compromise of the underlying system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Drupal Webform requires immediate attention from teams managing public-facing Drupal sites. The primary responsibility likely falls to the application owners and infrastructure or platform teams responsible for the Drupal instances. The first practical step is to identify all deployed instances of the Webform module, determine their reachability and criticality, and then confirm the accountable owner for remediation.

Application and platform teams own the issue.
Verify Webform module presence and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Drupal Webform module?

Drupal Webform is a feature-rich module used to build forms and manage user-submitted data directly on a Drupal website. It serves as a central component for collecting information from site visitors, such as contact requests, surveys, or registrations, and handles the backend processing of that data.

What does CVE-2026-96355 mean by code injection?

This vulnerability, classified as CWE-1336, occurs when the template engine processes untrusted data without proper sanitization. Essentially, the module confuses user-provided input with actual instructions, allowing an attacker to insert malicious code that the server then executes as if it were legitimate program logic.

How is this vulnerability triggered?

An attacker triggers this by submitting specially crafted input through a webform managed by the affected module. Importantly, this does not require the attacker to have an account or administrative access; however, if a form is not configured to process or render user input through the vulnerable template engine, it may not be subject to this specific execution path.

Is my site at risk?

According to Halo Surface Signal, this vulnerability is highly relevant if you host public-facing Drupal websites. Because the Webform module is intentionally designed to accept and process input from the public internet, instances of this software are frequently exposed, increasing the likelihood that they are reachable by external actors.

How should I respond to this vulnerability?

Your first step is to conduct an audit to identify all Drupal instances within your environment and confirm which ones have the Webform module installed. Once you have verified the presence of the module and its specific version, prioritize these systems based on their public accessibility and identify the teams responsible for managing them to prepare for remediation.

References

www.drupal.org/sa-contrib-2026-175

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.