CVE-2025-12848

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

Because this module fails to sufficiently escape filenames when displaying them, it is possibly vulnerable to a Cross-Site Scripting (XSS) exploit. The vulnerability appears only on Webforms that expose multiple file uploads; sites that do not use this feature are not vulnerable.

A cross-site scripting (XSS) vulnerability is a type of security flaw that allows attackers to inject malicious scripts into webpages. It often occurs when a site fails to properly validate or sanitize user input, enabling the execution of unauthorized code within a victim's browser. It is included in the OWASP Top Ten list of vulnerabilities, specifically in the third category of Injection. A web site compromised in this way may experience:

• Session hijacking
• Data theft
• Malware distribution
• Defacement or phishing and
• Privilege escalation.

This issue affects the Webform Multiple File Upload version 7.1.6 and lower.

‍

Details

Module Info

• Product: Drupal
• Affected code: Webform Multiple File Upload module
• Affected versions: <=7.1.6
• Project page: https://www.drupal.org/project/webform_multifile
• Fixed in:  Webform Multiple File Upload NES 7.1.7

‍

Vulnerability Info

This medium-severity vulnerability is found in all versions of the Drupal Webform Multiple File Upload module  for Drupal 7 sites.

‍

Mitigation

Users of the affected components should apply one of the following:

• Disable the Webform Multiple File Upload module.

• Sign up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.

‍

Credits

• Michael Hess (mlhess)

‍