PT-2025-48120 · Drupal+1 · Drupal Webform Multiple File Upload Module+1

Published 2025-11-26 · Updated 2025-12-05 · CVE-2025-12848

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/S:N/R:U/V:D/RE:L/U:Amber

Name of the Vulnerable Software and Affected Versions Drupal Webform Multiple File Upload module versions 7.x (affected versions not specified)

Description The Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) issue in the file name renderer. An unauthenticated attacker can exploit this by uploading a file with a malicious filename containing JavaScript code to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts in the context of the victim's browser. The issue is present in a third-party library. The vulnerable component is the file name renderer.

Recommendations Apply the patch available at https://github.com/fyneworks/multifile/pull/44.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-12848

Affected Products

Drupal Webform Multiple File Upload Module

Multifile

References · 13

• https://osv.dev/vulnerability/CVE-2025-12848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12848 · Security Note
• https://github.com/fyneworks/multifile · Note
• https://t.me/CVEtracker/38260 · Telegram Post
• https://d7security.org/security-advisories/D7SECURITY-SA-CONTRIB-2025-001 · Note
• https://twitter.com/VulmonFeeds/status/1993524774698471687 · Twitter Post
• https://twitter.com/transilienceai/status/1995334885922222429 · Twitter Post
• https://herodevs.com/vulnerability-directory/cve-2025-12848 · Note
• https://twitter.com/CVEnew/status/1993513513206083767 · Twitter Post
• https://d7es.tag1.com/security-advisories/webform-multiple-file-upload-critical-cross-site-scripting · Note
• https://drupal.org/node/3105204 · Vendor Advisory, Patch
• https://twitter.com/dailycve/status/1996973265726636278 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1995330878688366805 · Twitter Post