June 2026 - Security-news - lists.drupal.org

AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-054 Project: AI (Artificial Intelligence) [1] Date: 2026-June-24 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure / Cross-site Scripting Affected versions: <1.2.17 || >=1.3.0 <1.3.8 || >=1.4.0 <1.4.3 CVE IDs: CVE-2026-13234 Description: The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the ability to use an LLM to generate HTML or Markdown and preview it in a browser. Under certain circumstances, rendering of this HTML can lead to Cross Site Scripting, or exposing secret communications in the context of the LLM request. This vulnerability is mitigated by the fact that an attacker must be able to inject text into prompts to create an attack. Solution: Install the latest version: * If you use the AI module 1.2.16, upgrade to AI 1.2.17 [3] * If you use the AI module 1.3.7 upgrade to AI 1.3.8 [4] * If you use the AI module 1.4.2 upgrade to AI 1.4.3 [5] Reported By: * Drew Webber (mcdruid) [6] of the Drupal Security Team Fixed By: * Artem Dmitriiev (a.dmitriiev) [7] * Abhisek Mazumdar (abhisekmazumdar) [8] * AKHIL BABU (akhil babu) [9] * Marcus Johansson (marcus_johansson) [10] Coordinated By: * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Drew Webber (mcdruid) [12] of the Drupal Security Team * Juraj Nemec (poker10) [13] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3586527-ai-security/-/work_items/1 [14] ------------------------------------------------------------------------------ Contribution record [15] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai/releases/1.2.17 [4] https://www.drupal.org/project/ai/releases/1.3.8 [5] https://www.drupal.org/project/ai/releases/1.4.3 [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/admitriiev [8] https://www.drupal.org/u/abhisekmazumdar [9] https://www.drupal.org/u/akhil-babu [10] https://www.drupal.org/u/marcus_johansson [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/mcdruid [13] https://www.drupal.org/u/poker10 [14] https://git.drupalcode.org/security/3586527-ai-security/-/work_items/1 [15] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-053 Project: OpenAI Provider [1] Date: 2026-June-24 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Server-side Request Forgery Affected versions: <1.1.1 || >=1.2.0 <1.2.2 CVE IDs: CVE-2026-13233 Description: This module enables you to use OpenAI as a provider for the AI module. The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery (SSRF) vulnerability. This vulnerability is mitigated by the fact that an attacker must have the access to change the host url and a way to generate AI-generated images. Solution: Install the latest version: * If you use the OpenAI Provider module 1.1.0, upgrade to OpenAI Provider 1.1.1 [3] * If you use the OpenAI module 1.2.1 upgrade to OpenAI Provider 1.2.2 [4] Reported By: * Kuniyoshi Noguchi (kuninogu) [5] Fixed By: * Artem Dmitriiev (a.dmitriiev) [6] * Kuniyoshi Noguchi (kuninogu) [7] * Marcus Johansson (marcus_johansson) [8] Coordinated By: * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185237-ai_provider_openai-security/-/wo… [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/ai_provider_openai [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_provider_openai/releases/1.1.1 [4] https://www.drupal.org/project/ai_provider_openai/releases/1.2.2 [5] https://www.drupal.org/u/kuninogu [6] https://www.drupal.org/u/admitriiev [7] https://www.drupal.org/u/kuninogu [8] https://www.drupal.org/u/marcus_johansson [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/greggles [11] https://git.drupalcode.org/security/185237-ai_provider_openai-security/-/wo… [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-052 Project: Advanced Content Feedback (aka admin_feedback) [1] Date: 2026-June-24 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass / Insecure Direct Object Reference (IDOR) Affected versions: <2.8.0 CVE IDs: CVE-2026-13232 Description: This module enables you to collect feedback from your site visitors on content pages, allowing them to optionally attach a free-text comment to their Yes/No vote. The module doesn't sufficiently verify authorization over the targeted feedback record when processing a comment submission. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "give feedback". Note: "give feedback" is granted to anonymous and authenticated by default on install. Solution: Install the latest release: * If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8 [3] The comment endpoint now requires an HMAC-signed token bound to the specific feedback row (issued only to the visitor who cast that vote), and a comment may be written only once, preventing both forgery of arbitrary ids and replay. Reported By: * Bill Seremetis (bserem) [4] Fixed By: * Bill Seremetis (bserem) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185232-admin_feedback-security/-/work_i… [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/admin_feedback [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_feedback/releases/8.x-2.8 [4] https://www.drupal.org/u/bserem [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mcdruid [8] https://git.drupalcode.org/security/185232-admin_feedback-security/-/work_i… [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-051 Project: Advanced Content Feedback (aka admin_feedback) [1] Date: 2026-June-24 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <2.8.0 CVE IDs: CVE-2026-13231 Description: This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and providing dashboards for administrators to review the responses. The module doesn't sufficiently sanitize several administrator-configured response messages (the "Yes response", "No response", and the custom text shown on a "No" answer) under the scenario where those settings contain HTML or script markup, which is then emitted as raw HTML in the feedback response shown to visitors. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer admin feedback". Solution: Install the latest release: * If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8 [3] The configured plain-text responses are now escaped with `Html::escape()`, and the formatted "No" response is rendered through its configured text format filter (`check_markup()`) instead of being printed raw. Reported By: * Bill Seremetis (bserem) [4] Fixed By: * Bill Seremetis (bserem) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185233-admin_feedback-security/-/work_i… [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/admin_feedback [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_feedback/releases/8.x-2.8 [4] https://www.drupal.org/u/bserem [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://git.drupalcode.org/security/185233-admin_feedback-security/-/work_i… [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050
by security-news＠drupal.org 17 Jun '26

17 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-050 Project: Plotly.js Graphing [1] Date: 2026-June-17 Security risk: *Critical* 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: PHP object injection Affected versions: <3.0.2 CVE IDs: CVE-2026-55810 Description: The Plotly.js Graphing module provides a fully customizable implementation of the open source Plotly.js graphing library. The module stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when the data are unserialized. This vulnerability is mitigated by the fact that an attacker must have permission to edit a content entity with an attached plotly_js_graph field. In addition, the core JSON:API module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", which is not the default, or the attacker needs some other way to edit field values directly. Solution: Install the latest version: * If you use the Plotly.js Graphing module for Drupal, upgrade to plotly_js-3.0.2 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Stephen Mustgrave (smustgrave) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185192-plotly_js-security/-/work_items/1 [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/plotly_js [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/plotly_js/releases/3.0.2 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/smustgrave [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/xjm [9] https://git.drupalcode.org/security/185192-plotly_js-security/-/work_items/1 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049
by security-news＠drupal.org 17 Jun '26

17 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-049 Project: Flag attendance field [1] Date: 2026-June-17 Security risk: *Critical* 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: PHP object injection Affected versions: <1.2 CVE IDs: CVE-2026-55809 Description: The Flag attendance field module gives you the ability to add attendance by depending on Flag module [3]. flag_attendance_field stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when the data are unserialized. This vulnerability is mitigated by the fact that an attacker must have permission to edit a content entity with an attached flag_attendance_field field. In addition, the core JSON:API module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", which is not the default, or the attacker needs some other way to edit field values directly. Solution: Install the latest version: * If you use the Flag attendance field module for Drupal, upgrade to Flag attendance field 8.x-1.2 [4]. Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team Fixed By: * Anas Mawlawi (anas_maw) [6] * Benji Fisher (benjifisher) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team Coordinated By: * Benji Fisher (benjifisher) [9] of the Drupal Security Team * Drew Webber (mcdruid) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185193-flag_attendance_field-security/-… [12] ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/flag_attendance_field [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/flag [4] https://www.drupal.org/project/flag_attendance_field/releases/8.x-1.2 [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/anas_maw [7] https://www.drupal.org/u/benjifisher [8] https://www.drupal.org/u/mcdruid [9] https://www.drupal.org/u/benjifisher [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/u/xjm [12] https://git.drupalcode.org/security/185193-flag_attendance_field-security/-… [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
by security-news＠drupal.org 17 Jun '26

17 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-048 Project: Formatter Field [1] Date: 2026-June-17 Security risk: *Critical* 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: PHP object injection Affected versions: <2.0.0 CVE IDs: CVE-2026-12535 Description: The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a field, on a per-entity basis. formatter_field stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an Object Injection vulnerability when the data are unserialized. This vulnerability is mitigated by the fact that an attacker must have permission to edit a content entity with an attached formatter_field field. In addition, the core JSON:API module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", which is not the default, or the attacker needs some other way to edit field values directly. Solution: Install the latest version: * If you use the Formatter Field module, upgrade to Formatter Field 2.0.0 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Kostia Bohach (_shy) [5] Coordinated By: * Benji Fisher (benjifisher) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185191-formatter_field-security/-/work_… [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/formatter_field [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/formatter_field/releases/2.0.0 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/_shy [6] https://www.drupal.org/u/benjifisher [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/xjm [9] https://git.drupalcode.org/security/185191-formatter_field-security/-/work_… [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009
by security-news＠drupal.org 17 Jun '26

17 Jun '26

View online: https://www.drupal.org/sa-core-2026-009 Project: Drupal core [1] Date: 2026-June-02 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Improper validation Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55808 Description: The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior. Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.3.x, update to Drupal 11.3.12 [3]. * If you use Drupal 11.2.x, update to Drupal 11.2.14 [4]. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.11 [5]. * If you use Drupal 10.5.x, update to Drupal 10.5.12 [6]. Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 [7] and Drupal 9 [8] have both reached end-of-life.) Reported By: * cantina_security [9] Fixed By: * Björn Brala (bbrala) [10] * Kim Pepper (kim.pepper) [11] * Lee Rowlands (larowlan) [12] of the Drupal Security Team Coordinated By: * Damien McKenna (damienmckenna) [13] of the Drupal Security Team * Greg Knaddison (greggles) [14] of the Drupal Security Team * Lee Rowlands (larowlan) [15] of the Drupal Security Team * Dave Long (longwave) [16] of the Drupal Security Team * Juraj Nemec (poker10) [17] of the Drupal Security Team * Jess (xjm) [18] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185032-drupal-security/-/work_items/1 [19] ------------------------------------------------------------------------------ Contribution record [20] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/11.3.12 [4] https://www.drupal.org/project/drupal/releases/11.2.14 [5] https://www.drupal.org/project/drupal/releases/10.6.11 [6] https://www.drupal.org/project/drupal/releases/10.5.12 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/psa-2023-11-01 [9] https://www.drupal.org/u/cantina_security [10] https://www.drupal.org/u/bbrala [11] https://www.drupal.org/u/kimpepper [12] https://www.drupal.org/u/larowlan [13] https://www.drupal.org/u/damienmckenna [14] https://www.drupal.org/u/greggles [15] https://www.drupal.org/u/larowlan [16] https://www.drupal.org/u/longwave [17] https://www.drupal.org/u/poker10 [18] https://www.drupal.org/u/xjm [19] https://git.drupalcode.org/security/185032-drupal-security/-/work_items/1 [20] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
by security-news＠drupal.org 17 Jun '26

17 Jun '26

View online: https://www.drupal.org/sa-core-2026-008 Project: Drupal core [1] Date: 2026-June-02 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Server-side request forgery Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55807 Description: The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL. Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.3.x, update to Drupal 11.3.12 [3]. * If you use Drupal 11.2.x, update to Drupal 11.2.14 [4]. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.11 [5]. * If you use Drupal 10.5.x, update to Drupal 10.5.12 [6]. Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 [7] and Drupal 9 [8] have both reached end-of-life.) .. Required site changes for URL discovery Most users of the oEmbed functionality in Drupal likely use providers.json to define known providers (such as YouTube and Vimeo) for embedding content. If you are using URL discovery, you now need to set a list of trusted oEmbed discovery hosts in settings.php. This is an array containing a series of regular expressions for matching host names for discovery. It follows the same pattern as the existing trusted hosts settings [9]. Example: // Only allow URL discovery from example.com. $settings['media_oembed_discovery_trusted_host_patterns'] = [ '^example\.com$', ]; Reported By: * Hamed Kohi (0xhamy) [10] * assaf alassaf (ama62) [11] * Albert Skibinski (askibinski) [12] * Jon Minder (ayalon) [13] * Lautaro Casanova (betah4k) [14] * Gabe Sullice (gabesullice) [15] * John Morahan (john morahan) [16] * Michael Winser (michaelwinser) [17] * nbanderson [18] * offensive-ai [19] * Francesco Placella (plach) [20] * quynh ho (qquynh) [21] * Himanshu Anand (unknownhad) [22] Fixed By: * Lee Rowlands (larowlan) [23] of the Drupal Security Team * Dave Long (longwave) [24] of the Drupal Security Team * Drew Webber (mcdruid) [25] of the Drupal Security Team * Adam G-H (phenaproxima) [26] * Sean Blommaert (seanb) [27] Coordinated By: * Benji Fisher (benjifisher) [28] of the Drupal Security Team * cilefen (cilefen) [29] of the Drupal Security Team * Damien McKenna (damienmckenna) [30] of the Drupal Security Team * Mori Sugimoto (dokumori) [31] of the Drupal Security Team * Greg Knaddison (greggles) [32] of the Drupal Security Team * Lee Rowlands (larowlan) [33] of the Drupal Security Team * Dave Long (longwave) [34] of the Drupal Security Team * Drew Webber (mcdruid) [35] of the Drupal Security Team * James Gilliland (neclimdul) [36] of the Drupal Security Team * Juraj Nemec (poker10) [37] of the Drupal Security Team * Jess (xjm) [38] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185053-drupal-security/-/work_items/1 [39] ------------------------------------------------------------------------------ Contribution record [40] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/11.3.12 [4] https://www.drupal.org/project/drupal/releases/11.2.14 [5] https://www.drupal.org/project/drupal/releases/10.6.11 [6] https://www.drupal.org/project/drupal/releases/10.5.12 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/psa-2023-11-01 [9] https://www.drupal.org/docs/getting-started/installing-drupal/trusted-host-… [10] https://www.drupal.org/u/0xhamy [11] https://www.drupal.org/u/ama62 [12] https://www.drupal.org/u/askibinski [13] https://www.drupal.org/u/ayalon [14] https://www.drupal.org/u/betah4k [15] https://www.drupal.org/u/gabesullice [16] https://www.drupal.org/u/john-morahan [17] https://www.drupal.org/u/michaelwinser [18] https://www.drupal.org/u/nbanderson [19] https://www.drupal.org/u/offensive-ai [20] https://www.drupal.org/u/plach [21] https://www.drupal.org/u/qquynh [22] https://www.drupal.org/u/unknownhad [23] https://www.drupal.org/u/larowlan [24] https://www.drupal.org/u/longwave [25] https://www.drupal.org/u/mcdruid [26] https://www.drupal.org/u/phenaproxima [27] https://www.drupal.org/u/seanb [28] https://www.drupal.org/u/benjifisher [29] https://www.drupal.org/u/cilefen [30] https://www.drupal.org/u/damienmckenna [31] https://www.drupal.org/u/dokumori [32] https://www.drupal.org/u/greggles [33] https://www.drupal.org/u/larowlan [34] https://www.drupal.org/u/longwave [35] https://www.drupal.org/u/mcdruid [36] https://www.drupal.org/u/neclimdul [37] https://www.drupal.org/u/poker10 [38] https://www.drupal.org/u/xjm [39] https://git.drupalcode.org/security/185053-drupal-security/-/work_items/1 [40] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
by security-news＠drupal.org 17 Jun '26

17 Jun '26

View online: https://www.drupal.org/sa-core-2026-006 Project: Drupal core [1] Date: 2026-June-08 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Gadget chain Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || >=11.4.0 <11.4.0-rc2 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55804 Description: Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability. This issue is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.3.x, update to Drupal 11.3.12 [3]. * If you use Drupal 11.2.x, update to Drupal 11.2.14 [4]. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.11 [5]. * If you use Drupal 10.5.x, update to Drupal 10.5.12 [6]. Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 [7] and Drupal 9 [8] have both reached end-of-life.) Reported By: * Michael Maturi (michaelmaturi) [9] Fixed By: * Lee Rowlands (larowlan) [10] of the Drupal Security Team * Drew Webber (mcdruid) [11] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [12] Coordinated By: * Anna Kalata (akalata) [13] of the Drupal Security Team * Benji Fisher (benjifisher) [14] of the Drupal Security Team * cilefen (cilefen) [15] of the Drupal Security Team * Greg Knaddison (greggles) [16] of the Drupal Security Team * Lee Rowlands (larowlan) [17] of the Drupal Security Team * Dave Long (longwave) [18] of the Drupal Security Team * Drew Webber (mcdruid) [19] of the Drupal Security Team * Juraj Nemec (poker10) [20] of the Drupal Security Team * Jess (xjm) [21] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185171-drupal-security/-/work_items/1 [22] ------------------------------------------------------------------------------ Contribution record [23] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/11.3.12 [4] https://www.drupal.org/project/drupal/releases/11.2.14 [5] https://www.drupal.org/project/drupal/releases/10.6.11 [6] https://www.drupal.org/project/drupal/releases/10.5.12 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/psa-2023-11-01 [9] https://www.drupal.org/u/michaelmaturi [10] https://www.drupal.org/u/larowlan [11] https://www.drupal.org/u/mcdruid [12] https://www.drupal.org/u/mohit_aghera [13] https://www.drupal.org/u/akalata [14] https://www.drupal.org/u/benjifisher [15] https://www.drupal.org/u/cilefen [16] https://www.drupal.org/u/greggles [17] https://www.drupal.org/u/larowlan [18] https://www.drupal.org/u/longwave [19] https://www.drupal.org/u/mcdruid [20] https://www.drupal.org/u/poker10 [21] https://www.drupal.org/u/xjm [22] https://git.drupalcode.org/security/185171-drupal-security/-/work_items/1 [23] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0