- Webform versions prior to 1.x-4.26.6
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments.
In affected configurations, Webform did not sufficiently validate a managed file upload element when processing a new submission. A user with access to submit a vulnerable webform could potentially access other managed files they were not authorized to view.
This vulnerability is mitigated by the fact that a site must have a Webform with a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own webform submissions or sending uploads as email attachments.
Update your site to use the most recent version of Webform module. Download available on the Webform releases page.
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Jacob Rockowitz (jrockowitz)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Herb v/d Dool (herbdool) of the Backdrop Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team