October 2026 - Security-news - lists.drupal.org

Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-217 Project: Advanced Filesystem [1] Project machine name: advanced_filesystem Date: 2026-October-07 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-Site Request Forgery Affected versions: <1.0.28 CVE IDs: CVE-2026-107262 Description: Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability. The vulnerability is mitigated by the fact that advanced_filesystem_backup module must be enabled. Solution: Install the latest version: * If you use the Advanced File System module, upgrade to Advanced File System 1.0.28 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Cristiano Demari (cristianodemari) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/advanced_filesystem [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/advanced_filesystem/releases/1.0.28 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/cristianodemari [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-216 Project: Restrict route by IP [1] Project machine name: restrict_route_by_ip Date: 2026-October-07 Security risk: *Critical* 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.3.1 || >=2.0.0 <2.0.1 CVE IDs: CVE-2026-107255 Description: This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic. Solution: Install the latest version: * If you use the Restrict route by IP 2.0.x, upgrade to Restrict route by IP 2.0.1 [3] * If you use the Restrict route by IP 1.3.x, upgrade to Restrict route by IP 1.3.1 [4] Reported By: * Elia Wehbe (ewehbe) [5] Fixed By: * Elia Wehbe (ewehbe) [6] * solideogloria [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/restrict_route_by_ip [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/restrict_route_by_ip/releases/2.0.1 [4] https://www.drupal.org/project/restrict_route_by_ip/releases/1.3.1 [5] https://www.drupal.org/u/ewehbe [6] https://www.drupal.org/u/ewehbe [7] https://www.drupal.org/u/solideogloria [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-215 Project: Examples for Developers [1] Project machine name: examples Date: 2026-October-07 Security risk: *Less critical* 8 ∕ 25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Allocation of resources without limits or throttling Affected versions: <4.0.7 Description: The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Example" feature implemented by the email_example submodule can be used to send illegitimate emails to arbitrary email addresses. Therefore, the email_example sub-module is being removed from Examples for Developers until a version demonstrating security best practices can be added back in the future. Developers who based a new module on this example should review their code. Solution: Any site with the email_example submodule installed should uninstall it immediately. Then, install the latest version of Examples for Developers: * If you are using Examples for Developers 4.0.x, upgrade to Examples for Developers 4.0.7 [3]. Developers who based a new module or custom code on this example should review their code. Reported By: * Alberto Paderno (avpaderno) [4] Fixed By: * Alberto Paderno (avpaderno) [5] * Marco Villegas (marvil07) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/examples [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/examples/releases/4.0.7 [4] https://www.drupal.org/u/avpaderno [5] https://www.drupal.org/u/avpaderno [6] https://www.drupal.org/u/marvil07 [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-214 Project: Permissions by Term [1] Project machine name: permissions_by_term Date: 2026-October-07 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure CVE IDs: CVE-2026-107311 Description: This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API. This vulnerability is mitigated by the fact that it requires a specific module configuration, references to a deleted term, and access via JSON:API to be present. Solution: Install the latest version: * If you use the Permissions by Term module, upgrade to Permissions by Term 3.1.41 [3] Reported By: * ayrmax [4] Fixed By: * Peter Majmesku (jepster_) [5] * Marc-Oliver Teschke (marcoliver) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Damien McKenna (damienmckenna) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/permissions_by_term [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/permissions_by_term/releases/3.1.41 [4] https://www.drupal.org/u/ayrmax [5] https://www.drupal.org/u/jepster_ [6] https://www.drupal.org/u/marcoliver [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/damienmckenna [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-213 Project: Freelinking [1] Project machine name: freelinking Date: 2026-October-07 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure Affected versions: <4.0.3 || >=5.0.0 <5.0.0-alpha3 CVE IDs: CVE-2026-107310 Description: This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content. The module doesn’t sufficiently prevent page titles being viewed for certain privately-accessible URLs. This vulnerability is mitigated by the fact that an attacker must have access to use a text format with the Freelinking plugin configured to allow privately-accessible external URLs to be crawled. Site administrators may want to disable this functionality to evaluate any risk. Solution: Install the latest version: * If you use the Freelinking module, upgrade to Freelinking 4.0.3 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Marcus Johansson (marcus_johansson) [5] * Matthew Radcliffe (mradcliffe) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/freelinking [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/freelinking/releases/4.0.3 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/mradcliffe [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-212 Project: Easy Breadcrumb [1] Project machine name: easy_breadcrumb Date: 2026-October-07 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.0.11 CVE IDs: CVE-2026-107309 Description: This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment. This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" (term_hierarchy) must be enabled, and at least one term has a term in the parent hierarchy that is unpublished. Solution: Install the latest version: * If you use the Easy Breadcrumb module, upgrade to Easy Breadcrumb 2.0.11 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Brooke Mahoney (loopduplicate) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/easy_breadcrumb [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/easy_breadcrumb/releases/2.0.11 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/loopduplicate [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-211 Project: Country [1] Project machine name: country Date: 2026-October-07 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <2.1.3 || >=2.2.0 <2.2.1 CVE IDs: CVE-2026-107308 Description: The module Country provides a dedicated field type for Drupal core's official country list. The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability. This vulnerability is mitigated by the fact that it can not occur out of the box with the Country module, additional module(s) or custom code is required. Solution: Install the latest version: * If you use the Country module 2.2.x, upgrade to Country 2.2.1 [3]. * If you use the Country module 2.1.x, upgrade to Country 2.1.3 [4]. Reported By: * Conrad Lara (cmlara) [5] Fixed By: * Boris Doesborg (batigolix) [6] * Conrad Lara (cmlara) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Damien McKenna (damienmckenna) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/country [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/country/releases/2.2.1 [4] https://www.drupal.org/project/country/releases/2.1.3 [5] https://www.drupal.org/u/cmlara [6] https://www.drupal.org/u/batigolix [7] https://www.drupal.org/u/cmlara [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/damienmckenna [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-210 Project: SmartLinker AI [1] Project machine name: smartlinker_ai Date: 2026-October-07 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Information disclosure Affected versions: <1.0.3 CVE IDs: CVE-2026-107307 Description: This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to. The module's search query did not respect entity access when returning results to the browser. This vulnerability is mitigated by the fact that an user must have permission to use the AI CKEditor "Generate internal links" feature on a text format. Solution: Install the latest version: Upgrade to SmartLinker AI 1.0.3 [3]. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Marcus Johansson (marcus_johansson) [5] * Zeeshaan khann (zeeshan_khan) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/smartlinker_ai [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/smartlinker_ai/releases/1.0.3 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/zeeshan_khan [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-209 Project: Menu Link Attributes [1] Project machine name: menu_link_attributes Date: 2026-October-07 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <1.8.0 CVE IDs: CVE-2026-107306 Description: This module enables you to add HTML attributes to menu links and their container elements ( * ). The module doesn't sufficiently sanitize the attributes it applies to menu link container elements. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "/Administer menus and menu links/" and "/Use menu link attributes/". In addition, an unsafe container attribute must already be configured by a user with the restricted permission "/Administer menu link attributes/". The default configuration is not affected. Solution: Install the latest version: * If you use the Menu Link Attributes module for Drupal 8.x or later, update to Menu Link Attributes 8.x-1.8 [3]. After updating, run the database updates. The update removes any unsafe attribute definitions from the module's configuration and clears the render cache, so previously rendered menus no longer contain unsafe attributes. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Joshua Sedler (grevil) [5] * Marcus Johansson (marcus_johansson) [6] * Yannick (yannickoo) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/menu_link_attributes [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/menu_link_attributes/releases/8.x-1.8 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/grevil [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/yannickoo [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208
by security-news＠drupal.org 07 Oct '26

07 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-208 Project: DKAN [1] Project machine name: dkan Date: 2026-October-07 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <4.0.4 || >=4.1.0 <4.1.5 CVE IDs: CVE-2026-107267 Description: The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables and exposes them for querying with a JSON API. The module does not correctly check access for all of its endpoints, leading to a potential access bypass. The vulnerability is mitigated by the fact that it is only impactful for sites that do not give "access content" permission to the anonymous role. Solution: Install the latest version: * If you use DKAN 4.1.x, upgrade to DKAN 4.1.5 [3] * If you use DKAN 4.0.x, upgrade to DKAN 4.0.4 [4] Reported By: * Rodel Duterte (rduterte) [5] Fixed By: * Dan Feder (dafeder) [6] * Rodel Duterte (rduterte) [7] * Steve Wirt (swirt) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/dkan [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/dkan/releases/4.1.5 [4] https://www.drupal.org/project/dkan/releases/4.0.4 [5] https://www.drupal.org/u/rduterte [6] https://www.drupal.org/u/dafeder [7] https://www.drupal.org/u/rduterte [8] https://www.drupal.org/u/swirt [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0