CVE-2026-96370

Name of the Vulnerable Software and Affected Versions Drupal Webform versions 0.0.0 through 6.2.12 Drupal Webform versions 6.3.0 through 6.3.1

Description An incorrect authorization issue in the Webform Submission Export/Import submodule allows for Server Side Request Forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The submodule fails to sufficiently validate access to its export and import functionality. Consequently, a user with permissions to edit webform submissions and access webform results can access the import interface, including the remote URL import path.

Recommendations Update Drupal Webform to a version later than 6.2.12. Update Drupal Webform to a version later than 6.3.1. Disable the Webform Submission Export/Import submodule to mitigate the risk.