CVE-2025-12848

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12848", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-11-06T21:09:12.402Z", "datePublished": "2025-11-26T01:28:33.628Z", "dateUpdated": "2026-03-26T20:52:30.614Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-03-26T20:52:30.614Z"}, "title": "XSS vulnerability when rendering filename in Webform Multiform", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "Drupal", "product": "Drupal", "collectionURL": "https://www.drupal.org/project/webform_multifile", "packageName": "Webform Multifile Upload", "repo": "https://git.drupalcode.org/project/webform_multifile", "versions": [{"status": "affected", "version": "7.x-1.0", "lessThanOrEqual": "7.x-1.6", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious\nfilename containing JavaScript code (e.g., \"<img src=1 onerror=alert(document.domain)>\") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts\nin the context of the victim's browser.\n \nThe issue is present in a third-party library and has been addressed in a patch available at\u00a0 https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious<br>filename containing JavaScript code (e.g., \"&lt;img src=1 onerror=alert(document.domain)&gt;\") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts<br>in the context of the victim's browser.<br> <br>The issue is present in a third-party library and has been addressed in a patch available at&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/fyneworks/multifile/pull/44\">https://github.com/fyneworks/multifile/pull/44</a>. Users are advised to apply the provided patch or update to a fixed version of the module.<br><br><br>"}]}], "references": [{"url": "https://www.drupal.org/node/3105204", "tags": ["issue-tracking"]}, {"url": "https://www.d7security.org/security-advisories/D7SECURITY-SA-CONTRIB-2025-001/", "tags": ["third-party-advisory"]}, {"url": "https://www.herodevs.com/vulnerability-directory/cve-2025-12848", "tags": ["third-party-advisory"]}, {"url": "https://d7es.tag1.com/security-advisories/webform-multiple-file-upload-critical-cross-site-scripting", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "Automatable": "NOT_DEFINED", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/S:N/R:U/V:D/RE:L/U:Amber"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-26T14:18:51.075955Z", "id": "CVE-2025-12848", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-26T14:19:01.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12848", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-26T14:18:51.075955Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-26T14:18:55.570Z"}}], "cna": {"title": "XSS vulnerability when rendering filename in Webform Multiform", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/S:N/R:U/V:D/RE:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/webform_multifile", "vendor": "Drupal", "product": "Drupal", "versions": [{"status": "affected", "version": "7.x-1.0", "versionType": "custom", "lessThanOrEqual": "7.x-1.6"}], "packageName": "Webform Multifile Upload", "collectionURL": "https://www.drupal.org/project/webform_multifile", "defaultStatus": "unaffected"}], "references": [{"url": "https://www.drupal.org/node/3105204", "tags": ["issue-tracking"]}, {"url": "https://www.d7security.org/security-advisories/D7SECURITY-SA-CONTRIB-2025-001/", "tags": ["third-party-advisory"]}, {"url": "https://www.herodevs.com/vulnerability-directory/cve-2025-12848", "tags": ["third-party-advisory"]}, {"url": "https://d7es.tag1.com/security-advisories/webform-multiple-file-upload-critical-cross-site-scripting", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious\nfilename containing JavaScript code (e.g., \"<img src=1 onerror=alert(document.domain)>\") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts\nin the context of the victim's browser.\n \nThe issue is present in a third-party library and has been addressed in a patch available at\u00a0 https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module.", "supportingMedia": [{"type": "text/html", "value": "Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious<br>filename containing JavaScript code (e.g., \"&lt;img src=1 onerror=alert(document.domain)&gt;\") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts<br>in the context of the victim's browser.<br> <br>The issue is present in a third-party library and has been addressed in a patch available at&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/fyneworks/multifile/pull/44\">https://github.com/fyneworks/multifile/pull/44</a>. Users are advised to apply the provided patch or update to a fixed version of the module.<br><br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-03-26T20:52:30.614Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12848", "state": "PUBLISHED", "dateUpdated": "2026-03-26T20:52:30.614Z", "dateReserved": "2025-11-06T21:09:12.402Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-11-26T01:28:33.628Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.drupal.org/project/webform_multifile", "defaultStatus": "unaffected", "packageName": "Webform Multifile Upload", "product": "Drupal", "repo": "https://git.drupalcode.org/project/webform_multifile", "vendor": "Drupal", "versions": [{"lessThanOrEqual": "7.x-1.6", "status": "affected", "version": "7.x-1.0", "versionType": "custom"}]}], "source": "mlhess@drupal.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.2:*:*:*:*:drupal:*:*", "matchCriteriaId": "36B05E21-D024-4BDD-8278-D41CB19AC1E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.3:*:*:*:*:drupal:*:*", "matchCriteriaId": "E5483807-EF6D-49EB-BA44-B87F687B13C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.4:*:*:*:*:drupal:*:*", "matchCriteriaId": "AF414458-4EF4-4C86-84E2-22D3AAED513E", "vulnerable": true}, {"criteria": "cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.5:*:*:*:*:drupal:*:*", "matchCriteriaId": "379AA449-C4C9-475F-8614-A7654BE530EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.6:*:*:*:*:drupal:*:*", "matchCriteriaId": "B4B38B66-E62F-42EF-8979-4BDE49B5EEDC", "vulnerable": true}, {"criteria": "cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.x:dev:*:*:*:drupal:*:*", "matchCriteriaId": "BC4FEB91-00A6-40BD-A9AC-368E6AADBA45", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious\nfilename containing JavaScript code (e.g., \"<img src=1 onerror=alert(document.domain)>\") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts\nin the context of the victim's browser.\n \nThe issue is present in a third-party library and has been addressed in a patch available at\u00a0 https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module."}, {"lang": "es", "value": "El m\u00f3dulo Webform Multiple File Upload para Drupal 7.x contiene una vulnerabilidad de Cross-site Scripting (XSS) en el renderizador de nombres de archivo. Un atacante no autenticado puede explotar esta vulnerabilidad al subir un archivo con un nombre de archivo malicioso que contenga c\u00f3digo JavaScript (por ejemplo, \u2019[img src=1 onerror_disabled=alert( document.domain )]\u2019) a un nodo de Webform con un campo Multifile donde la validaci\u00f3n del tipo de archivo est\u00e1 deshabilitada. Esto permite la ejecuci\u00f3n de scripts arbitrarios en el contexto del navegador de la v\u00edctima.\n\nEl problema est\u00e1 presente en una biblioteca de terceros y se ha abordado en un parche disponible en https://github.com/fyneworks/multifile/pull/44. Se recomienda a los usuarios aplicar el parche proporcionado o actualizar a una versi\u00f3n corregida del m\u00f3dulo."}], "id": "CVE-2025-12848", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:U/V:D/RE:L/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "LOW"}, "source": "mlhess@drupal.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12848", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-26T14:18:51.075955Z", "version": "2.0.3"}}]}, "published": "2025-11-26T02:15:48.817", "references": [{"source": "mlhess@drupal.org", "url": "https://d7es.tag1.com/security-advisories/webform-multiple-file-upload-critical-cross-site-scripting"}, {"source": "mlhess@drupal.org", "url": "https://www.d7security.org/security-advisories/D7SECURITY-SA-CONTRIB-2025-001/"}, {"source": "mlhess@drupal.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.drupal.org/node/3105204"}, {"source": "mlhess@drupal.org", "url": "https://www.herodevs.com/vulnerability-directory/cve-2025-12848"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "mlhess@drupal.org", "type": "Secondary"}]}

{}

{"created": "2025-11-27T09:45:45.335789+00:00", "updated": "2025-11-27T09:45:45.335811+00:00", "vendors": ["drupal", "drupal$PRODUCT$drupal", "drupal$PRODUCT$webform_module"]}