S

Security advisories

http://drupal.org/security/rss.xml (RSS订阅地址)

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

<div class="field field-name-field-project field-type-entityreference field-label-inline clearfix"><div class="field-label">Project:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/project/drupal">Drupal core</a></div></div></div><div class="field field-name-drupalorg-sa-date field-type-text field-label-inline clearfix"><div class="field-label">Date:&nbsp;</div><div class="field-items"><div class="field-item even">2026-July-15</div></div></div><div class="field field-name-field-sa-criticality field-type-text field-label-inline clearfix"><div class="field-label">Security risk:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/security-team/risk-levels" class="moderately-critical" title="AC - Access complexity: Basic or routine (user must follow specific path) A - Authentication: User-level access (basic/commonly assigned permissions) CI - Confidentiality impact: Certain non-public data is released II - Integrity impact: Some data can be modified E - Exploit (Zero-day impact): Theoretical or white-hat (no public exploit code or documentation on development exists) TD - Target distribution: Default or common module configurations are exploitable, but a config change can disable the exploit"><strong>Moderately critical</strong> 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default</a></div></div></div><div class="field field-name-field-sa-type field-type-text field-label-inline clearfix"><div class="field-label">Vulnerability:&nbsp;</div><div class="field-items"><div class="field-item even">Cross-site scripting</div></div></div><div class="field field-name-field-affected-versions field-type-text field-label-inline clearfix"><div class="field-label">Affected versions:&nbsp;</div><div class="field-items"><div class="field-item even">&lt;10.6.13 || &gt;=11.3.0 &lt;11.3.14 || &gt;=11.4.0 &lt;11.4.4 || 11.0.* || 11.1.* || 11.2.*</div></div></div><div class="field field-name-field-sa-cve field-type-text field-label-inline clearfix"><div class="field-label">CVE IDs:&nbsp;</div><div class="field-items"><div class="field-item even">CVE-2026-55805</div></div></div><div class="field field-name-field-sa-description field-type-text-long field-label-above"><div class="field-label">Description:&nbsp;</div><div class="field-items"><div class="field-item even"><p>The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability.</p> <p>This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface. </p></div></div></div><div class="field field-name-field-sa-solution field-type-text-long field-label-above"><div class="field-label">Solution:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Install the latest version:</p> <p><strong>Drupal 11</strong></p> <ul> <li>If you use Drupal 11.4.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.4.4" rel="nofollow">Drupal 11.4.4</a>.</li> <li>If you use Drupal 11.3.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.3.14" rel="nofollow">Drupal 11.3.14</a>.</li> <li>Drupal 11.2.x and below are end-of-life and do not receive security coverage.</li> </ul> <p><strong>Drupal 10</strong></p> <ul> <li>If you use Drupal 10.6.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.6.13" rel="nofollow">Drupal 10.6.13</a>.</li> <li>Drupal 10.5.x and below are end-of-life and do not receive security coverage.</li> </ul> <p><a href="https://www.drupal.org/psa-2021-06-29" rel="nofollow">Drupal 8</a> and <a href="https://www.drupal.org/psa-2023-11-01" rel="nofollow">Drupal 9</a> have both reached end-of-life.</p></div></div></div><div class="field field-name-field-sa-reported-by field-type-text-long field-label-above"><div class="field-label">Reported By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/hai27ii2o" rel="nofollow">haii haii (hai27ii2o)</a> </li></ul></div></div></div><div class="field field-name-field-sa-fixed-by field-type-text-long field-label-above"><div class="field-label">Fixed By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/danielveza" rel="nofollow">danielveza</a> </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/mingsong" rel="nofollow">Mingsong (mingsong)</a> provisional member of the Drupal Security Team </li><li><a href="/u/neclimdul" rel="nofollow">James Gilliland (neclimdul)</a> of the Drupal Security Team </li></ul></div></div></div><div class="field field-name-field-sa-coordinated-by field-type-text-long field-label-above"><div class="field-label">Coordinated By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/greggles" rel="nofollow">Greg Knaddison (greggles)</a> of the Drupal Security Team </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/longwave" rel="nofollow">Dave Long (longwave)</a> of the Drupal Security Team </li><li><a href="/u/xjm" rel="nofollow">Jess (xjm)</a> of the Drupal Security Team </li></ul></div></div></div>

2026/7/15
阅读更多

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

<div class="field field-name-field-project field-type-entityreference field-label-inline clearfix"><div class="field-label">Project:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/project/drupal">Drupal core</a></div></div></div><div class="field field-name-drupalorg-sa-date field-type-text field-label-inline clearfix"><div class="field-label">Date:&nbsp;</div><div class="field-items"><div class="field-item even">2026-July-15</div></div></div><div class="field field-name-field-sa-criticality field-type-text field-label-inline clearfix"><div class="field-label">Security risk:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/security-team/risk-levels" class="moderately-critical" title="AC - Access complexity: Basic or routine (user must follow specific path) A - Authentication: User-level access (basic/commonly assigned permissions) CI - Confidentiality impact: Certain non-public data is released II - Integrity impact: Some data can be modified E - Exploit (Zero-day impact): Theoretical or white-hat (no public exploit code or documentation on development exists) TD - Target distribution: All module configurations are exploitable"><strong>Moderately critical</strong> 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All</a></div></div></div><div class="field field-name-field-sa-type field-type-text field-label-inline clearfix"><div class="field-label">Vulnerability:&nbsp;</div><div class="field-items"><div class="field-item even">Cross-site scripting</div></div></div><div class="field field-name-field-affected-versions field-type-text field-label-inline clearfix"><div class="field-label">Affected versions:&nbsp;</div><div class="field-items"><div class="field-item even">&gt;=11.3.0 &lt;11.3.14 || &gt;=11.4.0 &lt;11.4.4 || 11.2.*</div></div></div><div class="field field-name-field-sa-cve field-type-text field-label-inline clearfix"><div class="field-label">CVE IDs:&nbsp;</div><div class="field-items"><div class="field-item even">CVE-2026-15917</div></div></div><div class="field field-name-field-sa-description field-type-text-long field-label-above"><div class="field-label">Description:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Drupal core 11.2 and above integrate the HTMX JavaScript library.</p> <p>Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.</p> <p>The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.</p></div></div></div><div class="field field-name-field-sa-solution field-type-text-long field-label-above"><div class="field-label">Solution:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Install the latest version:</p> <p><strong>Drupal 11</strong></p> <ul> <li>If you use Drupal 11.4.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.4.4" rel="nofollow">Drupal 11.4.4</a>.</li> <li>If you use Drupal 11.3.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.3.14" rel="nofollow">Drupal 11.3.14</a>.</li> <li>Drupal 11.2.x and below are end-of-life and do not receive security coverage.</li> </ul> <p><strong>Drupal 10</strong></p> <ul> <li>Drupal 10 core is not affected. However, certain contributed modules may be affected, so a Drupal 10.6 fix is included as hardening.</li> </ul> <p><a href="https://www.drupal.org/psa-2021-06-29" rel="nofollow">Drupal 8</a> and <a href="https://www.drupal.org/psa-2023-11-01" rel="nofollow">Drupal 9</a> have both reached end-of-life.</p></div></div></div><div class="field field-name-field-sa-reported-by field-type-text-long field-label-above"><div class="field-label">Reported By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/prudloff" rel="nofollow">Pierre Rudloff (prudloff)</a> of the Drupal Security Team </li></ul></div></div></div><div class="field field-name-field-sa-fixed-by field-type-text-long field-label-above"><div class="field-label">Fixed By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/fathershawn" rel="nofollow">Shawn Duncan (fathershawn)</a> </li><li><a href="/u/prudloff" rel="nofollow">Pierre Rudloff (prudloff)</a> of the Drupal Security Team </li></ul></div></div></div><div class="field field-name-field-sa-coordinated-by field-type-text-long field-label-above"><div class="field-label">Coordinated By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/catch" rel="nofollow"> catch (catch)</a> of the Drupal Security Team </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/longwave" rel="nofollow">Dave Long (longwave)</a> of the Drupal Security Team </li><li><a href="/u/xjm" rel="nofollow">Jess (xjm)</a> of the Drupal Security Team </li></ul></div></div></div>

2026/7/15
阅读更多

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

<div class="field field-name-field-project field-type-entityreference field-label-inline clearfix"><div class="field-label">Project:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/project/drupal">Drupal core</a></div></div></div><div class="field field-name-drupalorg-sa-date field-type-text field-label-inline clearfix"><div class="field-label">Date:&nbsp;</div><div class="field-items"><div class="field-item even">2026-July-15</div></div></div><div class="field field-name-field-sa-criticality field-type-text field-label-inline clearfix"><div class="field-label">Security risk:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/security-team/risk-levels" class="moderately-critical" title="AC - Access complexity: Complex or highly specific (multi-step, unintuitive process with high number of dependencies) A - Authentication: None (all/anonymous users) CI - Confidentiality impact: Certain non-public data is released II - Integrity impact: Data integrity remains intact E - Exploit (Zero-day impact): Theoretical or white-hat (no public exploit code or documentation on development exists) TD - Target distribution: Only uncommon module configurations are exploitable"><strong>Moderately critical</strong> 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon</a></div></div></div><div class="field field-name-field-sa-type field-type-text field-label-inline clearfix"><div class="field-label">Vulnerability:&nbsp;</div><div class="field-items"><div class="field-item even">Information disclosure</div></div></div><div class="field field-name-field-affected-versions field-type-text field-label-inline clearfix"><div class="field-label">Affected versions:&nbsp;</div><div class="field-items"><div class="field-item even">&lt;10.6.13 || &gt;=11.3.0 &lt;11.3.14 || &gt;=11.4.0 &lt;11.4.4 || 11.0.* || 11.1.* || 11.2.*</div></div></div><div class="field field-name-field-sa-cve field-type-text field-label-inline clearfix"><div class="field-label">CVE IDs:&nbsp;</div><div class="field-items"><div class="field-item even">CVE-2026-15916</div></div></div><div class="field field-name-field-sa-description field-type-text-long field-label-above"><div class="field-label">Description:&nbsp;</div><div class="field-items"><div class="field-item even"><p>The Image module allows you to define and configure image fields.</p> <p>The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than <code class="language-php">private://</code>.</p> <p>This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.</p> <p>Information disclosure issues like this one are not generally given security advisories (as described in <a href="https://www.drupal.org/psa-2023-07-12" rel="nofollow">PSA-2023-07-12)</a>). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.</p></div></div></div><div class="field field-name-field-sa-solution field-type-text-long field-label-above"><div class="field-label">Solution:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Install the latest version:</p> <p><strong>Drupal 11</strong></p> <ul> <li>If you use Drupal 11.4.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.4.4" rel="nofollow">Drupal 11.4.4</a>.</li> <li>If you use Drupal 11.3.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.3.14" rel="nofollow">Drupal 11.3.14</a>.</li> <li>Drupal 11.2.x and below are end-of-life and do not receive security coverage.</li> </ul> <p><strong>Drupal 10</strong></p> <ul> <li>If you use Drupal 10.6.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.6.13" rel="nofollow">Drupal 10.6.13</a>.</li> <li>Drupal 10.5.x and below are end-of-life and do not receive security coverage.</li> </ul> <p><a href="https://www.drupal.org/psa-2021-06-29" rel="nofollow">Drupal 8</a> and <a href="https://www.drupal.org/psa-2023-11-01" rel="nofollow">Drupal 9</a> have both reached end-of-life.</p></div></div></div><div class="field field-name-field-sa-reported-by field-type-text-long field-label-above"><div class="field-label">Reported By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/offensive-ai" rel="nofollow">offensive-ai</a> </li></ul></div></div></div><div class="field field-name-field-sa-fixed-by field-type-text-long field-label-above"><div class="field-label">Fixed By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/benjifisher" rel="nofollow">Benji Fisher (benjifisher)</a> of the Drupal Security Team </li><li><a href="/u/kimpepper" rel="nofollow">Kim Pepper (kim.pepper)</a> </li><li><a href="/u/mohit_aghera" rel="nofollow">Mohit Aghera (mohit_aghera)</a> </li></ul></div></div></div><div class="field field-name-field-sa-coordinated-by field-type-text-long field-label-above"><div class="field-label">Coordinated By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/benjifisher" rel="nofollow">Benji Fisher (benjifisher)</a> of the Drupal Security Team </li><li><a href="/u/catch" rel="nofollow"> catch (catch)</a> of the Drupal Security Team </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/poker10" rel="nofollow">Juraj Nemec (poker10)</a> of the Drupal Security Team </li><li><a href="/u/xjm" rel="nofollow">Jess (xjm)</a> of the Drupal Security Team </li></ul></div></div></div>

2026/7/15
阅读更多

Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

<div class="field field-name-field-project field-type-entityreference field-label-inline clearfix"><div class="field-label">Project:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/project/drupal">Drupal core</a></div></div></div><div class="field field-name-drupalorg-sa-date field-type-text field-label-inline clearfix"><div class="field-label">Date:&nbsp;</div><div class="field-items"><div class="field-item even">2026-June-17</div></div></div><div class="field field-name-field-sa-criticality field-type-text field-label-inline clearfix"><div class="field-label">Security risk:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/security-team/risk-levels" class="moderately-critical" title="AC - Access complexity: Complex or highly specific (multi-step, unintuitive process with high number of dependencies) A - Authentication: User-level access (basic/commonly assigned permissions) CI - Confidentiality impact: Certain non-public data is released II - Integrity impact: Some data can be modified E - Exploit (Zero-day impact): Theoretical or white-hat (no public exploit code or documentation on development exists) TD - Target distribution: Only uncommon module configurations are exploitable"><strong>Moderately critical</strong> 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon</a></div></div></div><div class="field field-name-field-sa-type field-type-text field-label-inline clearfix"><div class="field-label">Vulnerability:&nbsp;</div><div class="field-items"><div class="field-item even">Improper validation</div></div></div><div class="field field-name-field-affected-versions field-type-text field-label-inline clearfix"><div class="field-label">Affected versions:&nbsp;</div><div class="field-items"><div class="field-item even">&lt;10.5.12 || &gt;=10.6.0 &lt;10.6.11 || &gt;=11.2.0 &lt;11.2.14 || &gt;=11.3.0 &lt;11.3.12 || 11.0.* || 11.1.*</div></div></div><div class="field field-name-field-sa-cve field-type-text field-label-inline clearfix"><div class="field-label">CVE IDs:&nbsp;</div><div class="field-items"><div class="field-item even">CVE-2026-55808</div></div></div><div class="field field-name-field-sa-description field-type-text-long field-label-above"><div class="field-label">Description:&nbsp;</div><div class="field-items"><div class="field-item even"><p>The JSON:API and REST modules allow you to upload image files to image fields.</p> <p>The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.</p> <p>Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.</p></div></div></div><div class="field field-name-field-sa-solution field-type-text-long field-label-above"><div class="field-label">Solution:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Install the latest version:</p> <p><strong>Drupal 11</strong></p> <ul> <li>If you use Drupal 11.3.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.3.12" rel="nofollow">Drupal 11.3.12</a>.</li> <li>If you use Drupal 11.2.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.2.14" rel="nofollow">Drupal 11.2.14</a>.</li> </ul> <p><strong>Drupal 10</strong></p> <ul> <li>If you use Drupal 10.6.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.6.11" rel="nofollow">Drupal 10.6.11</a>.</li> <li>If you use Drupal 10.5.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.5.12" rel="nofollow">Drupal 10.5.12</a>.</li> </ul> <p>Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (<a href="https://www.drupal.org/psa-2021-06-29" rel="nofollow">Drupal 8</a> and <a href="https://www.drupal.org/psa-2023-11-01" rel="nofollow">Drupal 9</a> have both reached end-of-life.)</p></div></div></div><div class="field field-name-field-sa-reported-by field-type-text-long field-label-above"><div class="field-label">Reported By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/cantina_security" rel="nofollow">cantina_security</a> </li></ul></div></div></div><div class="field field-name-field-sa-fixed-by field-type-text-long field-label-above"><div class="field-label">Fixed By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/bbrala" rel="nofollow">Björn Brala (bbrala)</a> </li><li><a href="/u/kimpepper" rel="nofollow">Kim Pepper (kim.pepper)</a> </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li></ul></div></div></div><div class="field field-name-field-sa-coordinated-by field-type-text-long field-label-above"><div class="field-label">Coordinated By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/damienmckenna" rel="nofollow">Damien McKenna (damienmckenna)</a> of the Drupal Security Team </li><li><a href="/u/greggles" rel="nofollow">Greg Knaddison (greggles)</a> of the Drupal Security Team </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/longwave" rel="nofollow">Dave Long (longwave)</a> of the Drupal Security Team </li><li><a href="/u/poker10" rel="nofollow">Juraj Nemec (poker10)</a> of the Drupal Security Team </li><li><a href="/u/xjm" rel="nofollow">Jess (xjm)</a> of the Drupal Security Team </li></ul></div></div></div>

2026/6/17
阅读更多

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

<div class="field field-name-field-project field-type-entityreference field-label-inline clearfix"><div class="field-label">Project:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/project/drupal">Drupal core</a></div></div></div><div class="field field-name-drupalorg-sa-date field-type-text field-label-inline clearfix"><div class="field-label">Date:&nbsp;</div><div class="field-items"><div class="field-item even">2026-June-17</div></div></div><div class="field field-name-field-sa-criticality field-type-text field-label-inline clearfix"><div class="field-label">Security risk:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/security-team/risk-levels" class="moderately-critical" title="AC - Access complexity: Basic or routine (user must follow specific path) A - Authentication: User-level access (basic/commonly assigned permissions) CI - Confidentiality impact: Certain non-public data is released II - Integrity impact: Data integrity remains intact E - Exploit (Zero-day impact): Theoretical or white-hat (no public exploit code or documentation on development exists) TD - Target distribution: Default or common module configurations are exploitable, but a config change can disable the exploit"><strong>Moderately critical</strong> 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default</a></div></div></div><div class="field field-name-field-sa-type field-type-text field-label-inline clearfix"><div class="field-label">Vulnerability:&nbsp;</div><div class="field-items"><div class="field-item even">Server-side request forgery</div></div></div><div class="field field-name-field-affected-versions field-type-text field-label-inline clearfix"><div class="field-label">Affected versions:&nbsp;</div><div class="field-items"><div class="field-item even">&lt;10.5.12 || &gt;=10.6.0 &lt;10.6.11 || &gt;=11.2.0 &lt;11.2.14 || &gt;=11.3.0 &lt;11.3.12 || 11.0.* || 11.1.*</div></div></div><div class="field field-name-field-sa-cve field-type-text field-label-inline clearfix"><div class="field-label">CVE IDs:&nbsp;</div><div class="field-items"><div class="field-item even">CVE-2026-55807</div></div></div><div class="field field-name-field-sa-description field-type-text-long field-label-above"><div class="field-label">Description:&nbsp;</div><div class="field-items"><div class="field-item even"><p>The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via <code class="language-php">providers.json</code> and via URL discovery.</p> <p>The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL.</p></div></div></div><div class="field field-name-field-sa-solution field-type-text-long field-label-above"><div class="field-label">Solution:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Install the latest version:</p> <p><strong>Drupal 11</strong></p> <ul> <li>If you use Drupal 11.3.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.3.12" rel="nofollow">Drupal 11.3.12</a>.</li> <li>If you use Drupal 11.2.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.2.14" rel="nofollow">Drupal 11.2.14</a>.</li> </ul> <p><strong>Drupal 10</strong></p> <ul> <li>If you use Drupal 10.6.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.6.11" rel="nofollow">Drupal 10.6.11</a>.</li> <li>If you use Drupal 10.5.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.5.12" rel="nofollow">Drupal 10.5.12</a>.</li> </ul> <p>Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (<a href="https://www.drupal.org/psa-2021-06-29" rel="nofollow">Drupal 8</a> and <a href="https://www.drupal.org/psa-2023-11-01" rel="nofollow">Drupal 9</a> have both reached end-of-life.)</p> <h4>Required site changes for URL discovery</h4> <p>Most users of the oEmbed functionality in Drupal likely use <code class="language-php">providers.json</code> to define known providers (such as YouTube and Vimeo) for embedding content.</p> <p>If you are using URL discovery, you now need to set a list of trusted oEmbed discovery hosts in <code class="language-php">settings.php</code>.</p> <p>This is an array containing a series of regular expressions for matching host names for discovery. It follows the same pattern as the existing <a href="https://www.drupal.org/docs/getting-started/installing-drupal/trusted-host-settings" rel="nofollow">trusted hosts settings</a>.</p> <p>Example:</p> <pre class="codeblock"><code class="language-php">// Only allow URL discovery from example.com. $settings['media_oembed_discovery_trusted_host_patterns'] = [ '^example\.com$', ]; </code></pre></div></div></div><div class="field field-name-field-sa-reported-by field-type-text-long field-label-above"><div class="field-label">Reported By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/0xhamy" rel="nofollow">Hamed Kohi (0xhamy)</a> </li><li><a href="/u/ama62" rel="nofollow">assaf alassaf (ama62)</a> </li><li><a href="/u/askibinski" rel="nofollow">Albert Skibinski (askibinski)</a> </li><li><a href="/u/ayalon" rel="nofollow">Jon Minder (ayalon)</a> </li><li><a href="/u/betah4k" rel="nofollow">Lautaro Casanova (betah4k)</a> </li><li><a href="/u/gabesullice" rel="nofollow">Gabe Sullice (gabesullice)</a> </li><li><a href="/u/john-morahan" rel="nofollow">John Morahan (john morahan)</a> </li><li><a href="/u/michaelwinser" rel="nofollow">Michael Winser (michaelwinser)</a> </li><li><a href="/u/nbanderson" rel="nofollow">nbanderson</a> </li><li><a href="/u/offensive-ai" rel="nofollow">offensive-ai</a> </li><li><a href="/u/plach" rel="nofollow">Francesco Placella (plach)</a> </li><li><a href="/u/qquynh" rel="nofollow">quynh ho (qquynh)</a> </li><li><a href="/u/unknownhad" rel="nofollow">Himanshu Anand (unknownhad)</a> </li></ul></div></div></div><div class="field field-name-field-sa-fixed-by field-type-text-long field-label-above"><div class="field-label">Fixed By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/longwave" rel="nofollow">Dave Long (longwave)</a> of the Drupal Security Team </li><li><a href="/u/mcdruid" rel="nofollow">Drew Webber (mcdruid)</a> of the Drupal Security Team </li><li><a href="/u/phenaproxima" rel="nofollow">Adam G-H (phenaproxima)</a> </li><li><a href="/u/seanb" rel="nofollow">Sean Blommaert (seanb)</a> </li></ul></div></div></div><div class="field field-name-field-sa-coordinated-by field-type-text-long field-label-above"><div class="field-label">Coordinated By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/benjifisher" rel="nofollow">Benji Fisher (benjifisher)</a> of the Drupal Security Team </li><li><a href="/u/cilefen" rel="nofollow">cilefen (cilefen)</a> of the Drupal Security Team </li><li><a href="/u/damienmckenna" rel="nofollow">Damien McKenna (damienmckenna)</a> of the Drupal Security Team </li><li><a href="/u/dokumori" rel="nofollow">Mori Sugimoto (dokumori)</a> of the Drupal Security Team </li><li><a href="/u/greggles" rel="nofollow">Greg Knaddison (greggles)</a> of the Drupal Security Team </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/longwave" rel="nofollow">Dave Long (longwave)</a> of the Drupal Security Team </li><li><a href="/u/mcdruid" rel="nofollow">Drew Webber (mcdruid)</a> of the Drupal Security Team </li><li><a href="/u/neclimdul" rel="nofollow">James Gilliland (neclimdul)</a> of the Drupal Security Team </li><li><a href="/u/poker10" rel="nofollow">Juraj Nemec (poker10)</a> of the Drupal Security Team </li><li><a href="/u/xjm" rel="nofollow">Jess (xjm)</a> of the Drupal Security Team </li></ul></div></div></div>

2026/6/17
阅读更多

Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

<div class="field field-name-field-project field-type-entityreference field-label-inline clearfix"><div class="field-label">Project:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/project/drupal">Drupal core</a></div></div></div><div class="field field-name-drupalorg-sa-date field-type-text field-label-inline clearfix"><div class="field-label">Date:&nbsp;</div><div class="field-items"><div class="field-item even">2026-June-17</div></div></div><div class="field field-name-field-sa-criticality field-type-text field-label-inline clearfix"><div class="field-label">Security risk:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/security-team/risk-levels" class="less-critical" title="AC - Access complexity: Basic or routine (user must follow specific path) A - Authentication: None (all/anonymous users) CI - Confidentiality impact: No confidentiality impact II - Integrity impact: Data integrity remains intact E - Exploit (Zero-day impact): Theoretical or white-hat (no public exploit code or documentation on development exists) TD - Target distribution: Default or common module configurations are exploitable, but a config change can disable the exploit"><strong>Less critical</strong> 9 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default</a></div></div></div><div class="field field-name-field-sa-type field-type-text field-label-inline clearfix"><div class="field-label">Vulnerability:&nbsp;</div><div class="field-items"><div class="field-item even">Cache poisoning and open redirect</div></div></div><div class="field field-name-field-affected-versions field-type-text field-label-inline clearfix"><div class="field-label">Affected versions:&nbsp;</div><div class="field-items"><div class="field-item even">&lt;10.5.12 || &gt;=10.6.0 &lt;10.6.11 || &gt;=11.2.0 &lt;11.2.14 || &gt;=11.3.0 &lt;11.3.12 || 11.0.* || 11.1.*</div></div></div><div class="field field-name-field-sa-cve field-type-text field-label-inline clearfix"><div class="field-label">CVE IDs:&nbsp;</div><div class="field-items"><div class="field-item even">CVE-2026-55806</div></div></div><div class="field field-name-field-sa-description field-type-text-long field-label-above"><div class="field-label">Description:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Drupal core ships a <code class="language-php">rebuild.php</code> front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition.</p> <p>This script doesn't correctly check the Host header against the list of trusted host patterns. This could result in cache poisoning or a redirect to an attacker-controlled domain.</p></div></div></div><div class="field field-name-field-sa-solution field-type-text-long field-label-above"><div class="field-label">Solution:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Install the latest version:</p> <p><strong>Drupal 11</strong></p> <ul> <li>If you use Drupal 11.3.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.3.12" rel="nofollow">Drupal 11.3.12</a>.</li> <li>If you use Drupal 11.2.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.2.14" rel="nofollow">Drupal 11.2.14</a>.</li> </ul> <p><strong>Drupal 10</strong></p> <ul> <li>If you use Drupal 10.6.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.6.11" rel="nofollow">Drupal 10.6.11</a>.</li> <li>If you use Drupal 10.5.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.5.12" rel="nofollow">Drupal 10.5.12</a>.</li> </ul> <p>Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (<a href="https://www.drupal.org/psa-2021-06-29" rel="nofollow">Drupal 8</a> and <a href="https://www.drupal.org/psa-2023-11-01" rel="nofollow">Drupal 9</a> have both reached end-of-life.)</p></div></div></div><div class="field field-name-field-sa-reported-by field-type-text-long field-label-above"><div class="field-label">Reported By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/melih-acikoz" rel="nofollow">Melih Acikoz</a> </li><li><a href="/u/michaelwinser" rel="nofollow">Michael Winser (michaelwinser)</a> </li><li><a href="/u/willempje2" rel="nofollow">Willem Drupal enthousiast (willempje2)</a> </li></ul></div></div></div><div class="field field-name-field-sa-fixed-by field-type-text-long field-label-above"><div class="field-label">Fixed By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li></ul></div></div></div><div class="field field-name-field-sa-coordinated-by field-type-text-long field-label-above"><div class="field-label">Coordinated By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/catch" rel="nofollow"> catch (catch)</a> of the Drupal Security Team </li><li><a href="/u/cilefen" rel="nofollow">cilefen (cilefen)</a> of the Drupal Security Team </li><li><a href="/u/greggles" rel="nofollow">Greg Knaddison (greggles)</a> of the Drupal Security Team </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/longwave" rel="nofollow">Dave Long (longwave)</a> of the Drupal Security Team </li><li><a href="/u/neclimdul" rel="nofollow">James Gilliland (neclimdul)</a> of the Drupal Security Team </li><li><a href="/u/poker10" rel="nofollow">Juraj Nemec (poker10)</a> of the Drupal Security Team </li><li><a href="/u/xjm" rel="nofollow">Jess (xjm)</a> of the Drupal Security Team </li></ul></div></div></div>

2026/6/17
阅读更多

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

<div class="field field-name-field-project field-type-entityreference field-label-inline clearfix"><div class="field-label">Project:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/project/drupal">Drupal core</a></div></div></div><div class="field field-name-drupalorg-sa-date field-type-text field-label-inline clearfix"><div class="field-label">Date:&nbsp;</div><div class="field-items"><div class="field-item even">2026-June-17</div></div></div><div class="field field-name-field-sa-criticality field-type-text field-label-inline clearfix"><div class="field-label">Security risk:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/security-team/risk-levels" class="moderately-critical" title="AC - Access complexity: Complex or highly specific (multi-step, unintuitive process with high number of dependencies) A - Authentication: Administrator (broad permissions required where “restrict access” is set to false) CI - Confidentiality impact: All non-public data is accessible II - Integrity impact: All data can be modified or deleted E - Exploit (Zero-day impact): Theoretical or white-hat (no public exploit code or documentation on development exists) TD - Target distribution: Only uncommon module configurations are exploitable"><strong>Moderately critical</strong> 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon</a></div></div></div><div class="field field-name-field-sa-type field-type-text field-label-inline clearfix"><div class="field-label">Vulnerability:&nbsp;</div><div class="field-items"><div class="field-item even">Gadget chain</div></div></div><div class="field field-name-field-affected-versions field-type-text field-label-inline clearfix"><div class="field-label">Affected versions:&nbsp;</div><div class="field-items"><div class="field-item even">&lt;10.5.12 || &gt;=10.6.0 &lt;10.6.11 || &gt;=11.2.0 &lt;11.2.14 || &gt;=11.3.0 &lt;11.3.12 || 11.0.* || 11.1.*</div></div></div><div class="field field-name-field-sa-cve field-type-text field-label-inline clearfix"><div class="field-label">CVE IDs:&nbsp;</div><div class="field-items"><div class="field-item even">CVE-2026-55804</div></div></div><div class="field field-name-field-sa-description field-type-text-long field-label-above"><div class="field-label">Description:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability.</p> <p>This issue is not directly exploitable.</p> <p>This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to <code class="language-php">unserialize()</code>.</p></div></div></div><div class="field field-name-field-sa-solution field-type-text-long field-label-above"><div class="field-label">Solution:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Install the latest version:</p> <p><strong>Drupal 11</strong></p> <ul> <li>If you use Drupal 11.3.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.3.12" rel="nofollow">Drupal 11.3.12</a>.</li> <li>If you use Drupal 11.2.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.2.14" rel="nofollow">Drupal 11.2.14</a>.</li> </ul> <p><strong>Drupal 10</strong></p> <ul> <li>If you use Drupal 10.6.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.6.11" rel="nofollow">Drupal 10.6.11</a>.</li> <li>If you use Drupal 10.5.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.5.12" rel="nofollow">Drupal 10.5.12</a>.</li> </ul> <p>Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (<a href="https://www.drupal.org/psa-2021-06-29" rel="nofollow">Drupal 8</a> and <a href="https://www.drupal.org/psa-2023-11-01" rel="nofollow">Drupal 9</a> have both reached end-of-life.)</p></div></div></div><div class="field field-name-field-sa-reported-by field-type-text-long field-label-above"><div class="field-label">Reported By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/michaelmaturi" rel="nofollow">Michael Maturi (michaelmaturi)</a> </li></ul></div></div></div><div class="field field-name-field-sa-fixed-by field-type-text-long field-label-above"><div class="field-label">Fixed By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/mcdruid" rel="nofollow">Drew Webber (mcdruid)</a> of the Drupal Security Team </li><li><a href="/u/mohit_aghera" rel="nofollow">Mohit Aghera (mohit_aghera)</a> </li></ul></div></div></div><div class="field field-name-field-sa-coordinated-by field-type-text-long field-label-above"><div class="field-label">Coordinated By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/akalata" rel="nofollow">Anna Kalata (akalata)</a> of the Drupal Security Team </li><li><a href="/u/benjifisher" rel="nofollow">Benji Fisher (benjifisher)</a> of the Drupal Security Team </li><li><a href="/u/cilefen" rel="nofollow">cilefen (cilefen)</a> of the Drupal Security Team </li><li><a href="/u/greggles" rel="nofollow">Greg Knaddison (greggles)</a> of the Drupal Security Team </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/longwave" rel="nofollow">Dave Long (longwave)</a> of the Drupal Security Team </li><li><a href="/u/mcdruid" rel="nofollow">Drew Webber (mcdruid)</a> of the Drupal Security Team </li><li><a href="/u/poker10" rel="nofollow">Juraj Nemec (poker10)</a> of the Drupal Security Team </li><li><a href="/u/xjm" rel="nofollow">Jess (xjm)</a> of the Drupal Security Team </li></ul></div></div></div>

2026/6/17
阅读更多

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

<div class="field field-name-field-project field-type-entityreference field-label-inline clearfix"><div class="field-label">Project:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/project/drupal">Drupal core</a></div></div></div><div class="field field-name-drupalorg-sa-date field-type-text field-label-inline clearfix"><div class="field-label">Date:&nbsp;</div><div class="field-items"><div class="field-item even">2026-June-17</div></div></div><div class="field field-name-field-sa-criticality field-type-text field-label-inline clearfix"><div class="field-label">Security risk:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/security-team/risk-levels" class="critical" title="AC - Access complexity: None (user visits page) A - Authentication: User-level access (basic/commonly assigned permissions) CI - Confidentiality impact: All non-public data is accessible II - Integrity impact: All data can be modified or deleted E - Exploit (Zero-day impact): Theoretical or white-hat (no public exploit code or documentation on development exists) TD - Target distribution: Only uncommon module configurations are exploitable"><strong>Critical</strong> 18 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon</a></div></div></div><div class="field field-name-field-sa-type field-type-text field-label-inline clearfix"><div class="field-label">Vulnerability:&nbsp;</div><div class="field-items"><div class="field-item even">PHP object injection</div></div></div><div class="field field-name-field-affected-versions field-type-text field-label-inline clearfix"><div class="field-label">Affected versions:&nbsp;</div><div class="field-items"><div class="field-item even">&lt;10.5.12 || &gt;=10.6.0 &lt;10.6.11 || &gt;=11.2.0 &lt;11.2.14 || &gt;=11.3.0 &lt;11.3.12 || 11.0.* || 11.1.*</div></div></div><div class="field field-name-field-sa-cve field-type-text field-label-inline clearfix"><div class="field-label">CVE IDs:&nbsp;</div><div class="field-items"><div class="field-item even">CVE-2026-55803</div></div></div><div class="field field-name-field-sa-description field-type-text-long field-label-above"><div class="field-label">Description:&nbsp;</div><div class="field-items"><div class="field-item even"><p><a href="https://www.drupal.org/sa-core-2019-003" rel="nofollow">SA-CORE-2019-003</a> added protection for fields that store serialized data to disallow direct writes via web services.</p> <p>The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain rare circumstances, potentially resulting in PHP Object Injection.</p> <p>This vulnerability is mitigated by the fact that in order to be exploitable:</p> <ul> <li>A site must use an entity reference field type that stores a serialized property.</li> <li>An attacker must have permission to write to the entity via JSON:API.</li> </ul> <p>No field type shipped with Drupal core meets these criteria, and contributed or user-created field types that do appear to be extremely unusual. This update protects all such fields; no changes are required in contributed modules.</p> <p>JSON:API is read-only by default, so sites are only affected if they have enabled write access (either through administrator configuration or the installation of a contributed or custom module that enables write access).</p> <h4>Drupal Steward protection:</h4> <p>This issue is being protected by <a href="https://www.drupal.org/steward" rel="nofollow">Drupal Steward</a>. In this instance, we believe that the WAF rule will provide mitigation for the common/obvious vulnerability paths, but may not cover all cases or work for all hosting providers. Additionally, several other core security advisories released today are <em>not</em> mitigated by Drupal Steward. Therefore, our recommended action is still to plan an actual Drupal update within 24 hours of this release.</p></div></div></div><div class="field field-name-field-sa-solution field-type-text-long field-label-above"><div class="field-label">Solution:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Install the latest version:</p> <p><strong>Drupal 11</strong></p> <ul> <li>If you use Drupal 11.3.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.3.12" rel="nofollow">Drupal 11.3.12</a>.</li> <li>If you use Drupal 11.2.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.2.14" rel="nofollow">Drupal 11.2.14</a>.</li> </ul> <p><strong>Drupal 10</strong></p> <ul> <li>If you use Drupal 10.6.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.6.11" rel="nofollow">Drupal 10.6.11</a>.</li> <li>If you use Drupal 10.5.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.5.12" rel="nofollow">Drupal 10.5.12</a>.</li> </ul> <p>Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (<a href="https://www.drupal.org/psa-2021-06-29" rel="nofollow">Drupal 8</a> and <a href="https://www.drupal.org/psa-2023-11-01" rel="nofollow">Drupal 9</a> have both reached end-of-life.)</p></div></div></div><div class="field field-name-field-sa-reported-by field-type-text-long field-label-above"><div class="field-label">Reported By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/michaelmaturi" rel="nofollow">Michael Maturi (michaelmaturi)</a> </li></ul></div></div></div><div class="field field-name-field-sa-fixed-by field-type-text-long field-label-above"><div class="field-label">Fixed By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/bbrala" rel="nofollow">Björn Brala (bbrala)</a> </li><li><a href="/u/berdir" rel="nofollow">Sascha Grossenbacher (berdir)</a> </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/longwave" rel="nofollow">Dave Long (longwave)</a> of the Drupal Security Team </li><li><a href="/u/mcdruid" rel="nofollow">Drew Webber (mcdruid)</a> of the Drupal Security Team </li></ul></div></div></div><div class="field field-name-field-sa-coordinated-by field-type-text-long field-label-above"><div class="field-label">Coordinated By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/akalata" rel="nofollow">Anna Kalata (akalata)</a> of the Drupal Security Team </li><li><a href="/u/benjifisher" rel="nofollow">Benji Fisher (benjifisher)</a> of the Drupal Security Team </li><li><a href="/u/damienmckenna" rel="nofollow">Damien McKenna (damienmckenna)</a> of the Drupal Security Team </li><li><a href="/u/david-strauss" rel="nofollow">David Strauss (david strauss)</a> of the Drupal Security Team </li><li><a href="/u/drumm" rel="nofollow">Neil Drumm (drumm)</a> of the Drupal Security Team </li><li><a href="/u/greggles" rel="nofollow">Greg Knaddison (greggles)</a> of the Drupal Security Team </li><li><a href="/u/hestenet" rel="nofollow">Tim Hestenes Lehnen (hestenet)</a> </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/longwave" rel="nofollow">Dave Long (longwave)</a> of the Drupal Security Team </li><li><a href="/u/mcdruid" rel="nofollow">Drew Webber (mcdruid)</a> of the Drupal Security Team </li><li><a href="/u/poker10" rel="nofollow">Juraj Nemec (poker10)</a> of the Drupal Security Team </li><li><a href="/u/ram4nd" rel="nofollow">Ra Mänd (ram4nd)</a> provisional member of the Drupal Security Team </li><li><a href="/u/xjm" rel="nofollow">Jess (xjm)</a> of the Drupal Security Team </li></ul></div></div></div>

2026/6/17
阅读更多

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

<div class="field field-name-field-project field-type-entityreference field-label-inline clearfix"><div class="field-label">Project:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/project/drupal">Drupal core</a></div></div></div><div class="field field-name-drupalorg-sa-date field-type-text field-label-inline clearfix"><div class="field-label">Date:&nbsp;</div><div class="field-items"><div class="field-item even">2026-May-20</div></div></div><div class="field field-name-field-sa-criticality field-type-text field-label-inline clearfix"><div class="field-label">Security risk:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/security-team/risk-levels" class="highly-critical" title="AC - Access complexity: None (user visits page) A - Authentication: None (all/anonymous users) CI - Confidentiality impact: All non-public data is accessible II - Integrity impact: All data can be modified or deleted E - Exploit (Zero-day impact): Exploit exists (documented or deployed exploit code already in the wild) TD - Target distribution: Only uncommon module configurations are exploitable"><strong>Highly critical</strong> 23 ∕ 25 AC:None/A:None/CI:All/II:All/E:Exploit/TD:Uncommon</a></div></div></div><div class="field field-name-field-sa-type field-type-text field-label-inline clearfix"><div class="field-label">Vulnerability:&nbsp;</div><div class="field-items"><div class="field-item even">SQL injection</div></div></div><div class="field field-name-field-affected-versions field-type-text field-label-inline clearfix"><div class="field-label">Affected versions:&nbsp;</div><div class="field-items"><div class="field-item even">&gt;= 8.9.0 &lt; 10.4.10 || &gt;= 10.5.0 &lt; 10.5.10 || &gt;= 10.6.0 &lt; 10.6.9 || &gt;= 11.0.0 &lt; 11.1.10 || &gt;= 11.2.0 &lt; 11.2.12 || &gt;= 11.3.0 &lt; 11.3.10</div></div></div><div class="field field-name-field-sa-cve field-type-text field-label-inline clearfix"><div class="field-label">CVE IDs:&nbsp;</div><div class="field-items"><div class="field-item even">CVE-2026-9082</div></div></div><div class="field field-name-field-sa-description field-type-text-long field-label-above"><div class="field-label">Description:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks.</p> <p>A vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL databases. This can lead to information disclosure, and in some cases privilege escalation, remote code execution, or other attacks.</p> <p>This vulnerability can be exploited by anonymous users.</p> <p>This SQL injection vulnerability <strong>only affects sites using PostgreSQL</strong>. However, the third-party dependency updates in these releases apply to all sites.</p> <h3>Updates</h3> <p><strong>May 22 2026, 04:30 UTC:</strong> The risk score has been updated to reflect that exploit attempts are now being detected in the wild.</p> <h3>Upstream security advisories</h3> <p>The Drupal releases for supported branches (11.3, 11.2, 10.6, and 10.5) in this advisory also include security updates for Symfony and Twig. Those projects have released important <a href="https://symfony.com/blog/category/security-advisories" rel="nofollow">Security Advisories</a> that were coordinated with this Drupal release, and Drupal is affected by some of the vulnerabilities.</p> <p>Depending on your site configuration and contrib modules, you may be vulnerable to one or more of these upstream issues, so <strong>updating these dependencies is highly recommended whether the SQL Injection vulnerability affects you or not</strong>. It is also recommended to review which user roles have the ability to update Twig templates, for example via Views or contributed modules.</p></div></div></div><div class="field field-name-field-sa-solution field-type-text-long field-label-above"><div class="field-label">Solution:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Install the latest version.</p> <h4>Drupal 11</h4> <ul> <li>If you use Drupal 11.3.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.3.10" rel="nofollow">Drupal 11.3.10</a>.</li> <li>If you use Drupal 11.2.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.2.12" rel="nofollow">Drupal 11.2.12</a>.</li> <li>If you use Drupal 11.1.x or 11.0.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.1.10" rel="nofollow">Drupal 11.1.10</a>.</li> </ul> <h4>Drupal 10</h4> <ul> <li>If you use Drupal 10.6.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.6.9" rel="nofollow">Drupal 10.6.9</a>.</li> <li>If you use Drupal 10.5.x, update to <a href="https://www.drupal.org/project/drupal/releases/10.5.10" rel="nofollow">Drupal 10.5.10</a>.</li> <li>If you use Drupal 10.4.x or earlier, update to <a href="https://www.drupal.org/project/drupal/releases/10.4.10" rel="nofollow">Drupal 10.4.10</a>.</li> </ul> <h4>Drupal 9 and 8</h4> <ul> <li>If you use any version of Drupal 9, try manually applying <a href="https://www.drupal.org/files/issues/2026-05-20/SA-CORE-2026-004-9.5.patch" rel="nofollow">the Drupal 9.5 patch for this issue</a>.</li> <li>If you use Drupal 8.9, try manually applying <a href="https://www.drupal.org/files/issues/2026-05-20/SA-CORE-2026-004-8.9.patch" rel="nofollow">the Drupal 8.9 patch for this issue</a>.</li> </ul> <p>Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (<a href="https://www.drupal.org/psa-2021-06-29" rel="nofollow">Drupal 8</a> and <a href="https://www.drupal.org/psa-2023-11-01" rel="nofollow">Drupal 9</a> have both reached end-of-life.) Due to this issue's severity, the unsupported releases and patches for unsupported versions are provided as a best effort. Those unsupported versions <em>will</em> still have other, previously disclosed security vulnerabilities.</p></div></div></div><div class="field field-name-field-sa-reported-by field-type-text-long field-label-above"><div class="field-label">Reported By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/michaelmaturi" rel="nofollow">Michael Maturi (michaelmaturi)</a> </li></ul></div></div></div><div class="field field-name-field-sa-fixed-by field-type-text-long field-label-above"><div class="field-label">Fixed By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/bbrala" rel="nofollow">Björn Brala (bbrala)</a> </li><li><a href="/u/benjifisher" rel="nofollow">Benji Fisher (benjifisher)</a> of the Drupal Security Team </li><li><a href="/u/catch" rel="nofollow"> catch (catch)</a> of the Drupal Security Team </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/longwave" rel="nofollow">Dave Long (longwave)</a> of the Drupal Security Team </li><li><a href="/u/mcdruid" rel="nofollow">Drew Webber (mcdruid)</a> of the Drupal Security Team </li><li><a href="/u/xjm" rel="nofollow">Jess (xjm)</a> of the Drupal Security Team </li></ul></div></div></div><div class="field field-name-field-sa-coordinated-by field-type-text-long field-label-above"><div class="field-label">Coordinated By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/akalata" rel="nofollow">Anna Kalata (akalata)</a> of the Drupal Security Team </li><li><a href="/u/benjifisher" rel="nofollow">Benji Fisher (benjifisher)</a> of the Drupal Security Team </li><li><a href="/u/catch" rel="nofollow"> catch (catch)</a> of the Drupal Security Team </li><li><a href="/u/damienmckenna" rel="nofollow">Damien McKenna (damienmckenna)</a> of the Drupal Security Team </li><li><a href="/u/drumm" rel="nofollow">Neil Drumm (drumm)</a> of the Drupal Security Team </li><li><a href="/u/greggles" rel="nofollow">Greg Knaddison (greggles)</a> of the Drupal Security Team </li><li><a href="/u/heine" rel="nofollow">Heine Deelstra (heine)</a> of the Drupal Security Team </li><li><a href="/u/hestenet" rel="nofollow">Tim Hestenes Lehnen (hestenet)</a> </li><li><a href="/u/longwave" rel="nofollow">Dave Long (longwave)</a> of the Drupal Security Team </li><li><a href="/u/mcdruid" rel="nofollow">Drew Webber (mcdruid)</a> of the Drupal Security Team </li><li><a href="/u/poker10" rel="nofollow">Juraj Nemec (poker10)</a> of the Drupal Security Team </li><li><a href="/u/prudloff" rel="nofollow">Pierre Rudloff (prudloff)</a> of the Drupal Security Team </li><li><a href="/u/quietone" rel="nofollow">quietone (quietone)</a> </li><li><a href="/u/xjm" rel="nofollow">Jess (xjm)</a> of the Drupal Security Team </li><li><a href="/u/yesct" rel="nofollow">Cathy Theys (yesct)</a> of the Drupal Security Team </li></ul></div></div></div>

2026/5/20
阅读更多

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

<div class="field field-name-field-project field-type-entityreference field-label-inline clearfix"><div class="field-label">Project:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/project/drupal">Drupal core</a></div></div></div><div class="field field-name-drupalorg-sa-date field-type-text field-label-inline clearfix"><div class="field-label">Date:&nbsp;</div><div class="field-items"><div class="field-item even">2026-April-15</div></div></div><div class="field field-name-field-sa-criticality field-type-text field-label-inline clearfix"><div class="field-label">Security risk:&nbsp;</div><div class="field-items"><div class="field-item even"><a href="/security-team/risk-levels" class="moderately-critical" title="AC - Access complexity: Basic or routine (user must follow specific path) A - Authentication: User-level access (basic/commonly assigned permissions) CI - Confidentiality impact: Certain non-public data is released II - Integrity impact: Some data can be modified E - Exploit (Zero-day impact): Theoretical or white-hat (no public exploit code or documentation on development exists) TD - Target distribution: Default or common module configurations are exploitable, but a config change can disable the exploit"><strong>Moderately critical</strong> 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default</a></div></div></div><div class="field field-name-field-sa-type field-type-text field-label-inline clearfix"><div class="field-label">Vulnerability:&nbsp;</div><div class="field-items"><div class="field-item even">Cross-site scripting</div></div></div><div class="field field-name-field-affected-versions field-type-text field-label-inline clearfix"><div class="field-label">Affected versions:&nbsp;</div><div class="field-items"><div class="field-item even">&gt;= 11.3.0 &lt; 11.3.7</div></div></div><div class="field field-name-field-sa-cve field-type-text field-label-inline clearfix"><div class="field-label">CVE IDs:&nbsp;</div><div class="field-items"><div class="field-item even">CVE-2026-6367</div></div></div><div class="field field-name-field-sa-description field-type-text-long field-label-above"><div class="field-label">Description:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5.</p> <p>The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user.</p></div></div></div><div class="field field-name-field-sa-solution field-type-text-long field-label-above"><div class="field-label">Solution:&nbsp;</div><div class="field-items"><div class="field-item even"><p>Install the latest version:</p> <ul> <li>If you use Drupal 11.3.x, update to <a href="https://www.drupal.org/project/drupal/releases/11.3.7" rel="nofollow">Drupal 11.3.7</a></li> <li>Drupal versions below 11.3 are not affected by this vulnerability</li> </ul></div></div></div><div class="field field-name-field-sa-reported-by field-type-text-long field-label-above"><div class="field-label">Reported By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/cantina_security" rel="nofollow">cantina_security</a> </li><li><a href="/u/dries" rel="nofollow">Dries Buytaert (dries)</a> </li><li><a href="/u/dtrizna" rel="nofollow">Dmitrijs Trizna (dtrizna)</a> </li><li><a href="/u/shirsendu-mondal" rel="nofollow">Shirsendu Mondal</a> </li></ul></div></div></div><div class="field field-name-field-sa-fixed-by field-type-text-long field-label-above"><div class="field-label">Fixed By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/mcdruid" rel="nofollow">Drew Webber (mcdruid)</a> of the Drupal Security Team </li><li><a href="/u/mingsong" rel="nofollow">Mingsong (mingsong)</a>, provisional member of the Drupal Security Team </li></ul></div></div></div><div class="field field-name-field-sa-coordinated-by field-type-text-long field-label-above"><div class="field-label">Coordinated By:&nbsp;</div><div class="field-items"><div class="field-item even"><ul> <li><a href="/u/damienmckenna" rel="nofollow">Damien McKenna (damienmckenna)</a> of the Drupal Security Team </li><li><a href="/u/greggles" rel="nofollow">Greg Knaddison (greggles)</a> of the Drupal Security Team </li><li><a href="/u/larowlan" rel="nofollow">Lee Rowlands (larowlan)</a> of the Drupal Security Team </li><li><a href="/u/poker10" rel="nofollow">Juraj Nemec (poker10)</a> of the Drupal Security Team </li><li><a href="/u/xjm" rel="nofollow">Jess (xjm)</a> of the Drupal Security Team </li></ul></div></div></div>

2026/4/15
阅读更多

推荐订阅

Oracle Solaris Third Party Bulletins

Oracle Security Alerts

Oracle Linux Bulletins

Atlassian Security advisories

Siemens Security Advisories