CVE-2026-96373

Name of the Vulnerable Software and Affected Versions Drupal Webform versions 0.0.0 through 6.2.12 Drupal Webform versions 6.3.0 through 6.3.1

Description An incorrect authorization issue allows forceful browsing when serving generated submission exports. The module fails to sufficiently validate requested filenames, which may allow a user with permission to view submission results for one webform to access or remove files from the configured export temporary directory that were not intended for that specific webform. This requires the attacker to have permission to view submission results and knowledge of the target filename.

Recommendations Update Drupal Webform to a version later than 6.2.12. Update Drupal Webform to a version later than 6.3.1.