CVE-2025-12848: Webform Multiple File Upload XSS Flaw

CVE-2025-12848 Overview

CVE-2025-12848 is a cross-site scripting (XSS) vulnerability in the Webform Multiple File Upload module for Drupal 7.x. The flaw resides in the file name renderer, which reflects uploaded filenames without proper output encoding. An unauthenticated attacker can upload a file whose name contains JavaScript, causing the payload to execute in a victim's browser when the filename is rendered. The vulnerability affects Webform Multiple File Upload versions 7.x-1.2 through 7.x-1.6 and the 7.x-1.x-dev branch. The root cause is contributed by a third-party library (fyneworks/multifile) bundled with the module, and a patch is available upstream.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in the context of any user viewing a Webform node containing a Multifile field with file type validation disabled, enabling session theft, defacement, and administrative account takeover.

Affected Products

Webform Multiple File Upload for Drupal 7.x-1.2 through 7.x-1.6
Webform Multiple File Upload 7.x-1.x-dev development branch
Drupal 7 sites using Webform nodes with a Multifile field where file type validation is disabled

Discovery Timeline

2025-11-26 - CVE-2025-12848 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12848

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified as [CWE-79]. The Webform Multiple File Upload module accepts files submitted through a Multifile field and later renders the uploaded filename in the Drupal page output. The renderer fails to sanitize or HTML-encode the filename before insertion into the DOM. When a filename contains HTML tags or event handlers, the browser parses and executes them as markup rather than treating them as text.

Because the vulnerable code path is reachable through an anonymous webform submission, no authentication is required to plant the payload. Any authenticated user, including administrators, who later views the filename triggers script execution in their session context. This enables cookie theft, forced administrative actions, and further compromise of the Drupal site.

Root Cause

The defect exists in the third-party fyneworks/multifile jQuery plugin bundled by the Webform Multiple File Upload module. The plugin writes user-controlled filenames directly into HTML without escaping. The module relies on Drupal's file type validation to reject unusual filenames, but when a site administrator disables file type validation on the Multifile field, arbitrary filenames including HTML metacharacters flow into the renderer unchecked.

Attack Vector

An unauthenticated attacker navigates to a public Webform containing a Multifile field with file type validation disabled. The attacker uploads a file with a crafted name such as <img src=1 onerror=alert(document.domain)>.txt. When the filename is rendered — for example on the submission confirmation page, in the submission list, or in administrative review views — the injected img tag executes the onerror handler in the victim's browser. Administrators reviewing submissions are high-value targets, because their sessions can be used to install modules, modify content, or exfiltrate data.

No verified proof-of-concept code is published. The vulnerability mechanism is described in the Tag1 Security Advisory and the D7 Security Advisory 2025-001.

Detection Methods for CVE-2025-12848

Indicators of Compromise

Uploaded files under the Drupal sites/default/files/ webform directories with filenames containing HTML tags, <script>, onerror=, onload=, or javascript: substrings.
Webform submission records in the database whose file metadata fields contain angle brackets or JavaScript event handlers.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing webform submission pages.

Detection Strategies

Query the Drupal file_managed table for filenames matching patterns like %<%, %onerror%, or %script% to identify stored payloads.
Inspect web server access logs for POST requests to webform submission endpoints containing multipart filenames with HTML metacharacters.
Monitor administrative session activity for anomalous privileged actions immediately following visits to /admin/content/webform or submission review pages.

Monitoring Recommendations

Enable Drupal's dblog or syslog module and alert on repeated file upload events from anonymous users on nodes with Multifile fields.
Deploy a web application firewall rule that blocks multipart upload requests whose filename parameter contains <, >, or common XSS event handler tokens.
Track browser-side content security policy (CSP) violation reports to detect script execution attempts on webform administration pages.

How to Mitigate CVE-2025-12848

Immediate Actions Required

Apply the upstream patch from the fyneworks/multifile pull request or update Webform Multiple File Upload to a fixed release as instructed in the Drupal Security Advisory.
Re-enable file type validation on every Webform Multifile field until the patched module is deployed.
Audit existing submissions and remove files whose names contain HTML or JavaScript payloads.

Patch Information

The fix is published upstream at the fyneworks/multifile pull request and is incorporated into the module release referenced by the Drupal Security Advisory 3105204. Site owners running Drupal 7 should note that Drupal 7 reached end-of-life and third-party long-term support is provided by vendors such as those documented in the Tag1 Security Advisory and the HeroDev CVE-2025-12848 Listing.

Workarounds

Enforce file type validation (allow only specific extensions such as pdf, png, jpg) on every Multifile field to reject filenames containing angle brackets.
Restrict access to webforms containing Multifile fields to authenticated, trusted roles until the module is patched.
Deploy a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce impact of reflected payloads.
Serve uploaded files from a separate domain and enforce Content-Disposition: attachment to prevent inline rendering.

bash

# Configuration example: restrict allowed file extensions on the Multifile field
# via drush on Drupal 7 to remove executable/HTML-capable extensions
drush php-eval "\$node = node_load(NODE_ID); \
  foreach (\$node->webform['components'] as &\$c) { \
    if (\$c['type'] === 'multifile') { \
      \$c['extra']['filtering']['types'] = array('pdf','png','jpg','jpeg','gif'); \
      \$c['extra']['filtering']['addextensions'] = ''; \
    } \
  } \
  node_save(\$node);"