Overview
The Webform Multiple File Upload module for Drupal 7.x has a security flaw known as a cross-site scripting (XSS) vulnerability. This issue allows an attacker to run harmful code in a user’s web browser. The problem lies within how file names are processed, making it possible for attackers to embed malicious JavaScript when uploading files, especially if file type checks are turned off.
CVE Details
This vulnerability is identified as CVE-2025-12848.
- Product: Webform Multiple File Upload module for Drupal 7.x
- Published: November 26, 2025
- Severity: Medium
- Status: Analyzed
Affected Products
The following versions of the Webform Multiple File Upload module for Drupal 7.x are affected by this vulnerability:
- 7.x-1.2
- 7.x-1.3
- 7.x-1.4
- 7.x-1.5
- 7.x-1.6
- 7.x-1.x-dev
Current Status
This vulnerability has been analyzed and confirmed. The good news is that a fix has been identified and implemented in a third-party library that the module uses. A patch is available to address this issue.
Severity Level
The vulnerability has a CVSS score of 6.1, which categorizes it as a Medium severity issue. This means that while it’s a significant concern, it’s not typically as critical as high or critical severity vulnerabilities. However, it’s still important to address it promptly to prevent potential attacks.
Possible Solutions
Users of the affected Webform Multiple File Upload module for Drupal 7.x are strongly advised to take action. The issue stems from a third-party library. A patch is available to resolve this vulnerability. Users should:
- Apply the provided patch from the third-party library, available at: https://github.com/fyneworks/multifile/pull/44
- Alternatively, update to a fixed version of the Webform Multiple File Upload module as soon as one becomes available.
References
https://www.drupal.org/node/3105204
https://github.com/fyneworks/multifile/pull/44
