November 2026 - Security-news

S3 File System CORS Upload - Critical - Access bypass - SA-CONTRIB-2026-295
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-295 Project: S3 File System CORS Upload [1] Project machine name: s3fs_cors Date: 2026-November-04 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2026-122057 Description: This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits. The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to. Solution: Install the latest version: * Upgrade to S3 File System CORS Upload 8.x-1.3 [3]. Reported By: * Lucas Hedding (heddn) [4] Fixed By: * Lucas Hedding (heddn) [5] * James Scott (jayelless) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/s3fs_cors [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/s3fs_cors/releases/8.x-1.3 [4] https://www.drupal.org/u/heddn [5] https://www.drupal.org/u/heddn [6] https://www.drupal.org/u/jayelless [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Content Synchronizer - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-294
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-294 Project: Content Synchronizer [1] Project machine name: content_synchronizer Date: 2026-November-04 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <4.1.1 CVE IDs: CVE-2026-118566 Description: The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. The module doesn't sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting (XSS) vulnerability. Solution: Install the latest version: * Upgrade to Content Synchronizer 4.1.1 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Oleh Shevchuk (alt.dev) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/content_synchronizer [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/content_synchronizer/releases/4.1.1 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/altdev [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mcdruid [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Content Synchronizer - Critical - Remote code execution - SA-CONTRIB-2026-293
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/sa-contrib-2026-293 Project: Content Synchronizer [1] Project machine name: content_synchronizer Date: 2026-November-04 Security risk: *Critical* 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote code execution Affected versions: <4.1.1 CVE IDs: CVE-2026-118547 Description: The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. A maliciously crafted import file can cause untrusted data to be deserialized (PHP Object Injection, CWE-502), potentially leading to remote code execution. Solution: Install the latest version: * Upgrade to Content Synchronizer 4.1.1 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Oleh Shevchuk (alt.dev) [5] * Bohdan Artemchuk (bohart) [6] * Drew Webber (mcdruid) [7] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Neil Drumm (drumm) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Drew Webber (mcdruid) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/content_synchronizer [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/content_synchronizer/releases/4.1.1 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/altdev [6] https://www.drupal.org/u/bohart [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/drumm [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/mcdruid [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/xjm [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Security support for Drupal core minor versions reduced to 8 months - PSA-2026-11-02
by security-news＠drupal.org 04 Nov '26

04 Nov '26

View online: https://www.drupal.org/psa-2026-11-02 Date: 2026-November-02 Description: .... Background Drupal has supported each minor release of Drupal (example: 11.3, 11.4) for 12 months each since the release of Drupal 8.6 in 2018. Like all open source projects [1], Drupal is enduring a "tsunami" of security reports [2] due to the prevalence of AI tools, and this has created more work than the Drupal Security Team, especially with its current levels of funding, can sustain. For site owners, this introduces risks that security fixes will take longer to release, which gives more time for malicious actors armed with LLMs to find attacks. The Drupal Security Team and Drupal core release managers explored several options, and ultimately landed on a compromise that brings other benefits such as better alignment with Symfony upstream releases. We will continue protecting Drupal sites for at least 4 years on each major version, while cutting backport work for core security advisories by 30%. .... Drupal minor versions will receive 8 months of security coverage Beginning in 2027, Drupal minor versions will receive 8 months of overlapping security coverage (rather than 12 months). This will apply to all versions supported in 2027, meaning that: * Drupal 11.3 (released December 2025) will still be supported until December 2026. * Drupal 11.4 (released June 2026) will be supported until April 2027 while the old schedule is being phased out. * Drupal 12.0 and 11.5 (scheduled for December 2026) will be supported until August 2027. * Drupal 12.1 and 11.6 (scheduled for June 2027) will be supported until February 2028. Each minor version will have six months of bugfix support followed by two months of security-only support. The final minor version for each major receives six months of bugfix support followed by six months of security support. .... Major versions are still supported for at least 4 years While the duration of overlapping support for individual minor versions will be reduced, major versions of Drupal core will still be supported for at least four years. This means that: * Drupal 10 will still be supported until December 2026. * Drupal 11 (released August 2024) will still be supported until December 2028. * Drupal 12 (scheduled for December 2026) will be supported until December 2030. Coordinated By: * Benji Fisher (benjifisher) [3] of the Drupal Security Team * catch (catch) [4] of the Drupal Security Team * Gábor Hojtsy (gábor hojtsy) [5] * Greg Knaddison (greggles) [6] of the Drupal Security Team * Lee Rowlands (larowlan) [7] of the Drupal Security Team * Dave Long (longwave) [8] of the Drupal Security Team * James Gilliland (neclimdul) [9] of the Drupal Security Team * quietone (quietone) [10] * Angie Byron (webchick) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team * Cathy Theys (yesct) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://github.blog/security/supply-chain-security/inside-the-advisory-data… [2] https://tech.yahoo.com/cybersecurity/articles/open-source-cybersecurity-ai-… [3] https://www.drupal.org/u/benjifisher [4] https://www.drupal.org/u/catch [5] https://www.drupal.org/u/g%C3%A1bor-hojtsy [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/longwave [9] https://www.drupal.org/u/neclimdul [10] https://www.drupal.org/u/quietone [11] https://www.drupal.org/u/webchick [12] https://www.drupal.org/u/xjm [13] https://www.drupal.org/u/yesct [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0