Drupal Webform implements a template engine that improperly neutralizes special elements in user input. This flaw permits an attacker to inject code that is executed on the server. The consequence is the ability to run arbitrary commands, gain full control of the web server, and compromise the confidentiality, integrity, and availability of the affected system.

The vulnerability affects the Drupal Webform module. Versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 are susceptible. Users running any of these releases should verify whether their instance uses the vulnerable module version.

The CVSS score of 9.1 indicates a high severity. The EPSS score is <1%, indicating low exploitation probability. The attacker would need to submit crafted data through a Webform interface, a common entry point already exposed a public URL. Given the high impact of code injection and the absence of known mitigations in the affected releases, the risk remains significant until a patched or newer version is deployed.