DRUPAL-CONTRIB-2020-011
This module enables you to build forms and surveys in Drupal.
The module doesn't sufficiently filter webform element properties (attributes) under the scenario of editing a webform. Malicious user could craft such an attribute (#element_validate, for example) that would invoke execution of undesired PHP code.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform").
What each source reports
OSV No score
This module enables you to build forms and surveys in Drupal.
The module doesn't sufficiently filter webform element properties (attributes) under the scenario of editing a webform. Malicious user could craft such an attribute (#element_validate, for example) that would invoke execution of undesired PHP code.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform").
- Record
DRUPAL-CONTRIB-2020-011- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/webformPackagist:https://packages.drupal.org/8 |
before 5.11.0 | 5.11.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2020-011 is a vulnerability with no CVSS score yet in drupal/webform, published May 6, 2020. No source lists public exploit code. Fixed in drupal/webform 5.11.0.