Remote

Drupal Security Team

@drupalsecurity@drupal.community

mastodon 4.7.2

Republish Drupal Security Advisories & related news. Follow Drupal Security Team. Contact @greggles@drupal.community to get RT. DM & mentions not actively monitored. https://drupal.org/node/101494

551 Followers

5 Following

30 Posts

Joined December 16, 2022

Source of Advisories:

https://www.drupal.org/security/

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

Replying to

The Drupal Security Team estimates that up to 5% of Drupal sites may be vulnerable to this highly critical issue. Furthermore, a majority of Drupal sites may also be affected by the Symfony and Twig security advisories published today, so all sites should update soon. Details in the advisory above.

5

0

4

0

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

Drupal-related security releases today include those referenced below. You can start updating dependencies from Symfony and doing testing steps now.

5

1

5

1

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

Replying to

Site owners are encouraged to get their sites ready for a release of Drupal core that may affect them. Site owners should make upgrades easier (e.g. update to the most recent release available, improve deployment automation, improve automated testing) given the current security climate.

3

1

7

0

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

https://www.drupal.org/sa-contrib-2026-039

LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

This module configures default editorial workflows for LocalGov Drupal content types. It provides a Drupal content moderation workflow, a content approvals dashboard, content scheduling and content preview. The module doesn't sufficiently restrict access to a view of Service Contacts at which exposes the names and content items assigned to each Service Contact.

1

0

1

0

Drupal Security Team @drupalsecurity@drupal.community

· 18mo ago

Replying to

Responses are welcome to the survey for the next few days, but any responses delivered today will be included in the Drupalcon Presentation tomorrow!

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 13mo ago

Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100

https://www.drupal.org/sa-contrib-2025-100

Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100

This module enables you to to easily create and manage faceted search interfaces. The module doesn’t sufficiently filter certain user-provided text leading to a cross site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer facets”. CVSS risk score (experimental) 4.8 / Medium

0

0

1

0

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

https://www.drupal.org/sa-contrib-2026-047

Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

Composer - Critical - Unsupported - SA-CONTRIB-2026-046

https://www.drupal.org/sa-contrib-2026-046

Composer - Critical - Unsupported - SA-CONTRIB-2026-046

The security team is marking the Composer module for Drupal project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... Note: this is about a project for the Drupal system that makes use of

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045

https://www.drupal.org/sa-contrib-2026-045

Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044

https://www.drupal.org/sa-contrib-2026-044

Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Read from a file" feature implemented by the file_example submodule can be used to expose any file that PHP can access. Therefore, the file_example sub-module is being removed from Examples for Developers until a version

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043

https://www.drupal.org/sa-contrib-2026-043

Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043

This module integrates the Tagify JavaScript library to enhance entity reference selection in entity reference widgets. The module does not properly sanitise the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This results in a cross-site scripting vulnerability that may allow attackers to execute arbitrary JavaScript in the context of the

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042

https://www.drupal.org/sa-contrib-2026-042

Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042

This module provides spam protection using the CleanTalk cloud service. The module doesn't sufficiently sanitize API response messages before rendering them in HTML output. The _cleantalk_die() and ct_die() functions output the CleanTalk API response message directly into HTML without proper sanitization, allowing potential injection of arbitrary HTML or JavaScript. This

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041

https://www.drupal.org/sa-contrib-2026-041

Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041

The module doesn't sufficiently sanitize customer comments in the order receipt email template; this could be exploited to achieve Cross-site Scripting (XSS). This vulnerability is mitigated by the fact that it only affects installations with Checkout (commerce_checkout) enabled, and the "Comments" checkout pane (id: customer_comments) is explicitly used, which is disabled by

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

TacJS - Moderately critical - Improper Access Control - SA-CONTRIB-2026-040

https://www.drupal.org/sa-contrib-2026-040

TacJS - Moderately critical - Improper Access Control - SA-CONTRIB-2026-040

This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup inside of content leading to an attacker being able to delete arbitrary cookies. This vulnerability is mitigated by the fact that an attacker needs to be able to insert specific data attributes in the page. For additional

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 4mo ago

Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

https://www.drupal.org/sa-contrib-2026-038

Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

The Basket module enables e-commerce and checkout functionality for Drupal sites. The module does not sufficiently sanitize user-supplied data before passing it to PHP's unserialize(). An attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the site codebase or installed dependencies, this can result in arbitrary PHP code

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 5mo ago

Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037

https://www.drupal.org/sa-contrib-2026-037

Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037

This module enables you to export entity date fields as iCal feeds. The module doesn't sufficiently check entity or field access or sanitize user inputs when generating iCal feeds. This vulnerability is not mitigated by any permission, the routes are accessible to all anonymous users with no configuration required.

0

0

1

0

Drupal Security Team @drupalsecurity@drupal.community

· 5mo ago

Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036

https://www.drupal.org/sa-contrib-2026-036

Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036

This module enables you to open content already on the page within a colorbox. The module doesn't sufficiently sanitize the data-colorbox-inline attribute value before passing it to jQuery, leading to a Cross-Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 5mo ago

Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035

https://www.drupal.org/sa-contrib-2026-035

Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035

The GTranslate module provides a language switcher widget for Drupal sites. The module’s widget JavaScript did not sufficiently validate that document.currentScript referred to the executing script element. A user who can add HTML to a page could cause the generated language-switcher links to point to an unintended domain. This vulnerability is mitigated by the fact that an

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 5mo ago

Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034

https://www.drupal.org/sa-contrib-2026-034

Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034

Node view permissions module enables permissions "View own content" and "View any content" for each content type on permissions page The module doesn't sufficiently handle the case where a user is cancelled and their content is reassigned to the anonymous user. This vulnerability is mitigated by the fact that only private contents where anonymous should not have view access

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 5mo ago

Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033

https://www.drupal.org/sa-contrib-2026-033

Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033

This module enables you to obfuscate email addresses in content. The module doesn't sufficiently sanitize user input via the Twig filter. This vulnerability is mitigated by the fact that it only affects sites using the ROT13 encoding and where an attacker can enter content that is filtered using the module's Twig filter.

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 3mo ago

Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066 https://www.drupal.org/sa-contrib-2026-066

Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

The Canvas module allow you to upload image files via a custom API. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 2mo ago

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011 https://www.drupal.org/sa-core-2026-011

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 2w ago

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176 https://www.drupal.org/sa-contrib-2026-176

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

The Cloud module enables users to manage cloud infrastructure through Drupal. The Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. An attacker who can intercept these connections may obtain secret tokens or other credentials, potentially allowing unauthorized access to the connected infrastructure.

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 2w ago

Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183 https://www.drupal.org/sa-contrib-2026-183

Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183

This module enables sites to block access for the administrative user account (user 1) or users with the administrator role. The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be able to authenticate through certain alternative authentication methods. This

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 2w ago

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188 https://www.drupal.org/sa-contrib-2026-188

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token, potentially leading to a denial of service. Sites are affected simply by having the

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 2w ago

Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186 https://www.drupal.org/sa-contrib-2026-186

Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields.

0

0

0

0

Drupal Security Team @drupalsecurity@drupal.community

· 2w ago

Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191 https://www.drupal.org/sa-contrib-2026-191

Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. This bypasses Drupal's text format filtering and output sanitization mechanisms.

0

0

0

0