CVE-2026-96357

Name of the Vulnerable Software and Affected Versions Drupal Webform module (affected versions not specified)

Description The Webform module fails to properly force the download of certain uploaded file types when they are served. In specific site configurations, a file uploaded via a webform can be rendered inline by a browser, leading to cross-site scripting (XSS), where malicious scripts are executed in the victim's browser. Approximately 436,300 instances were identified globally. This issue requires a user with permissions to create or edit webforms to allow the affected file extensions, and a victim must manually open the uploaded file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.