Drupal Webform and Webform REST flaws fixed in September advisory

CERT-BUND advisory WID-SEC-2026-3554 covers flaws in Drupal modules Webform and Webform REST, with risks of data manipulation, disclosure and cross-site scripting. Fixes ship in Webform 6.2.12 and 6.3.1 and Webform REST 4.2.1, alongside 14 other contributed projects.

• Webform is fixed in 6.2.12 and 6.3.1, Webform REST in 4.2.1
• Impact includes data manipulation, disclosure and cross-site scripting
• 14 other modules are affected, including Cloud 7.0.1 and Project Browser 2.0.3
• ZoomEye counted 436,286 exposed Drupal installs on 24 September 2026