On September 23, 2026, Drupal’s security team published around twenty advisories for the Webform module in a single window, including one critical flaw that allows remote code execution. The fix, version 6.3.1, bundles 22 corrections into a single package so site maintainers don’t have to chase a long string of partial updates. The module powers tens of thousands of Drupal sites used for form collection, which makes the patch a priority for any technical team running it.
A critical flaw in the template engine
The most severe advisory, tracked as SA-CONTRIB-2026-175 and assigned CVE-2026-96355, describes a failure to sufficiently exclude certain format templates from token replacement. An attacker can submit data that then gets evaluated as template code, with impact ranging from information disclosure to stored cross-site scripting, up to remote code execution depending on site configuration. Drupal core is not affected: the flaw lives entirely in the contributed module.
Around twenty more advisories, from XSS to access bypass
The rest of the batch is mostly rated “moderately critical”: access-control bypass on submissions, server-side request forgery, cross-site scripting across several field handlers, and one denial-of-service issue rated less critical. The release also hardens, outside of any CVE, JSON:API responses, submission exports and imports, uploaded-file delivery, and HTTP response token rendering.
| Advisory | Type | Severity |
|---|---|---|
| SA-CONTRIB-2026-175 | Remote code execution | Critical |
| SA-CONTRIB-2026-174 | Access bypass | Moderately critical |
| SA-CONTRIB-2026-172 | Cross-site scripting | Moderately critical |
| SA-CONTRIB-2026-170 | Denial of service | Less critical |
| SA-CONTRIB-2026-164 | Access bypass, SSRF | Moderately critical |
| 15 further advisories | XSS, access bypass | Moderately to less critical |
Update without delay
The fix comes down to one command for sites managed with Composer, the method Mail Studio recommends for any production Drupal site.
composer require 'drupal/webform:^6.3.1'
drush updb
drush crAround twenty advisories published on the same day for a single module is the sign of a coordinated audit, not neglect by the maintainers.
What to remember
The Webform module ships its densest security update of 2026. The SA-CONTRIB-2026-175 flaw alone justifies an emergency update for any site collecting data through publicly exposed forms. Teams that already apply a minimal security baseline on their CMS gain reaction time, but that doesn’t replace the patch itself.
A batch of twenty advisories at once always looks a bit alarming when it lands in the inbox, but it’s actually the best possible outcome: a coordinated audit and a single release beat a trickle of isolated patches that eventually stop getting tracked. For clients still weighing Drupal against a lighter CMS, an episode like this shouldn’t tip the scale either way — it’s precisely the sign of a contrib ecosystem correcting itself seriously — Simon Janvier.
Further reading: the full SA-CONTRIB-2026-175 advisory on Drupal.org.
