Webform Release Notes

Notes

This is the initial release of the Webform NES module.

Security

• Contains fix for the exploit described in SA-CONTRIB-2026-169 (CVE-2026-96366). The file component now rejects file IDs that were not uploaded by the submitting user.
• Contains fix for the exploit described in SA-CONTRIB-2026-172 (CVE-2026-96357).
  • Links to uploaded files that browsers render inline (HTML, XML, PDF, Atom) now use the download attribute.
  • Private-scheme uploads of those types are now served with Content-Disposition: attachment.
  • image/svg+xml and application/xhtml+xml were added to the default list of types that are forced to download.
  • Protection is also broadened beyond that list to any type ending in +xml (such as application/rss+xml or application/atomcat+xml), matching Webform 6.x for modern Drupal.
  • Public-scheme files are served by the web server and are not covered by the header change.

Tests

• Added new tests that verify the exploits are patched.