Medium 6.1Published Nov 26, 2025

CVE-2025-12848Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer.

Updated under an hour ago (2026-10-19 08:00 UTC)

Does this affect you?

It affects webform_multiple_file_upload_project webform_multiple_file_upload. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for webform_multiple_file_upload_project webform_multiple_file_upload

Exploited in the last 30 days

Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious filename containing JavaScript code (e.g., "<img src=1 onerror=alert(document.domain)>") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts in the context of the victim's browser. The issue is present in a third-party library and has been addressed in a patch available at https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module.

CVSS: 6.1 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

webform_multiple_file_upload_project webform_multiple_file_upload webform_multiple_file_upload_project:webform_multiple_file_upload	7.x-1.2; 7.x-1.3; 7.x-1.4; 7.x-1.5; 7.x-1.6; 7.x-1.x	NVD

References

https://d7es.tag1.com/security-advisories/webform-multiple-file-upload-critical-cross-site-scripting
https://www.d7security.org/security-advisories/D7SECURITY-SA-CONTRIB-2025-001/
https://www.drupal.org/node/3105204patch, vendor-advisory
https://www.herodevs.com/vulnerability-directory/cve-2025-12848

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.