June 2026 - Security-news - lists.drupal.org

Drupal core - Critical - PHP object injection - SA-CORE-2026-005
by security-news＠drupal.org 17 Jun '26

17 Jun '26

View online: https://www.drupal.org/sa-core-2026-005 Project: Drupal core [1] Date: 2026-June-05 Security risk: *Critical* 18 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: PHP object injection Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || >=11.4.0 <11.4.0-rc2 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55803 Description: SA-CORE-2019-003 [3] added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain rare circumstances, potentially resulting in PHP Object Injection. This vulnerability is mitigated by the fact that in order to be exploitable: * A site must use an entity reference field type that stores a serialized property. * An attacker must have permission to write to the entity via JSON:API. No field type shipped with Drupal core meets these criteria, and contributed or user-created field types that do appear to be extremely unusual. This update protects all such fields; no changes are required in contributed modules. JSON:API is read-only by default, so sites are only affected if they have enabled write access (either through administrator configuration or the installation of a contributed or custom module that enables write access). .. DrupalSteward protection: This issue is being protected by Drupal Steward [4]. In this instance, we believe that the WAF rule will provide mitigation for the common/obvious vulnerability paths, but may not be able to cover all cases or work for all hosting providers. Additionally, several other core security advisories released today are /not/ mitigated by Drupal Steward. Therefore, our recommended action is still to plan an actual Drupal update within 24 hours of this release. Solution: Install the latest version: *Drupal 11* * If you use Drupal 11.3.x, update to Drupal 11.3.12 [5]. * If you use Drupal 11.2.x, update to Drupal 11.2.14 [6]. *Drupal 10* * If you use Drupal 10.6.x, update to Drupal 10.6.11 [7]. * If you use Drupal 10.5.x, update to Drupal 10.5.12 [8]. Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 [9] and Drupal 9 [10] have both reached end-of-life.) Reported By: * Michael Maturi (michaelmaturi) [11] Fixed By: * Björn Brala (bbrala) [12] * Sascha Grossenbacher (berdir) [13] * Lee Rowlands (larowlan) [14] of the Drupal Security Team * Dave Long (longwave) [15] of the Drupal Security Team * Drew Webber (mcdruid) [16] of the Drupal Security Team Coordinated By: * Anna Kalata (akalata) [17] of the Drupal Security Team * Benji Fisher (benjifisher) [18] of the Drupal Security Team * Damien McKenna (damienmckenna) [19] of the Drupal Security Team * David Strauss (david strauss) [20] of the Drupal Security Team * Neil Drumm (drumm) [21] of the Drupal Security Team * Greg Knaddison (greggles) [22] of the Drupal Security Team * Tim Hestenes Lehnen (hestenet) [23] * Lee Rowlands (larowlan) [24] of the Drupal Security Team * Dave Long (longwave) [25] of the Drupal Security Team * Drew Webber (mcdruid) [26] of the Drupal Security Team * Juraj Nemec (poker10) [27] of the Drupal Security Team * Ra Mänd (ram4nd) [28] provisional member of the Drupal Security Team * Jess (xjm) [29] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185158-drupal-security/-/work_items/1 [30] ------------------------------------------------------------------------------ Contribution record [31] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/steward [5] https://www.drupal.org/project/drupal/releases/11.3.12 [6] https://www.drupal.org/project/drupal/releases/11.2.14 [7] https://www.drupal.org/project/drupal/releases/10.6.11 [8] https://www.drupal.org/project/drupal/releases/10.5.12 [9] https://www.drupal.org/psa-2021-06-29 [10] https://www.drupal.org/psa-2023-11-01 [11] https://www.drupal.org/u/michaelmaturi [12] https://www.drupal.org/u/bbrala [13] https://www.drupal.org/u/berdir [14] https://www.drupal.org/u/larowlan [15] https://www.drupal.org/u/longwave [16] https://www.drupal.org/u/mcdruid [17] https://www.drupal.org/u/akalata [18] https://www.drupal.org/u/benjifisher [19] https://www.drupal.org/u/damienmckenna [20] https://www.drupal.org/u/david-strauss [21] https://www.drupal.org/u/drumm [22] https://www.drupal.org/u/greggles [23] https://www.drupal.org/u/hestenet [24] https://www.drupal.org/u/larowlan [25] https://www.drupal.org/u/longwave [26] https://www.drupal.org/u/mcdruid [27] https://www.drupal.org/u/poker10 [28] https://www.drupal.org/u/ram4nd [29] https://www.drupal.org/u/xjm [30] https://git.drupalcode.org/security/185158-drupal-security/-/work_items/1 [31] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047
by security-news＠drupal.org 10 Jun '26

10 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-047 Project: Brute force attack protection [1] Date: 2026-June-10 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-11915 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/bfap_sb [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Composer - Critical - Unsupported - SA-CONTRIB-2026-046
by security-news＠drupal.org 10 Jun '26

10 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-046 Project: Composer [1] Date: 2026-June-10 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-11914 Description: The security team is marking the Composer module for Drupal project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] /Note: this is about a project for the Drupal system that makes use of composer. It is not a vulnerability in the composer software itself./ Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/composer [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045
by security-news＠drupal.org 10 Jun '26

10 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-045 Project: Mother May I [1] Date: 2026-June-10 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-11913 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/mothermayi [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044
by security-news＠drupal.org 10 Jun '26

10 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-044 Project: Examples for Developers [1] Date: 2026-June-10 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <4.0.6 CVE IDs: CVE-2026-11909 Description: The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Read from a file" feature implemented by the file_example submodule can be used to expose any file that PHP can access. Therefore, the file_example sub-module is being removed from Examples for Developers until a version demonstrating file security best practices can be added back in the future. Developers who based a new module on this example should review their code for an access bypass. Solution: Any site with the file_example submodule installed should uninstall it immediately. Then, install the latest version of Examples for Developers: * If you are using Examples for Developers 4.0.x, upgrade to Examples for Developers 4.0.6 [3]. Developers who based a new module on this example should review their code for an access bypass. Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Alberto Paderno (avpaderno) [5] * Pierre Rudloff (prudloff) [6] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/42-examples-security/-/work_items/1 [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/examples [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/examples/releases/4.0.6 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/avpaderno [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://git.drupalcode.org/security/42-examples-security/-/work_items/1 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043
by security-news＠drupal.org 10 Jun '26

10 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-043 Project: Tagify [1] Date: 2026-June-10 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting (XSS) Affected versions: <1.2.52 CVE IDs: CVE-2026-11908 Description: This module integrates the Tagify JavaScript library to enhance entity reference selection in entity reference widgets. The module does not properly sanitise the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This results in a cross-site scripting vulnerability that may allow attackers to execute arbitrary JavaScript in the context of the user’s session. The vulnerability is mitigated by the fact an attacker must have a role with permission to create or edit taxonomy terms in a vocabulary. Solution: Install the latest version of the Tagify module that includes a fix for sanitising parent term names in the Tagify dropdown rendering. * If you use the Tagify module for Drupal, upgrade to tagify 1.2.52 [3]. More information will be provided in the project release notes once the fixed version is published. Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * David Galeano (gxleano) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Dave Long (longwave) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185106-tagify-security/-/work_items/1 [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/tagify [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tagify/releases/1.2.52 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/gxleano [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/longwave [8] https://www.drupal.org/u/prudloff [9] https://git.drupalcode.org/security/185106-tagify-security/-/work_items/1 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042
by security-news＠drupal.org 03 Jun '26

03 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-042 Project: Anti-Spam by CleanTalk [1] Date: 2026-June-03 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Affected versions: <9.7.1 CVE IDs: CVE-2026-10770 Description: This module provides spam protection using the CleanTalk cloud service. The module doesn't sufficiently sanitize API response messages before rendering them in HTML output. The _cleantalk_die() and ct_die() functions output the CleanTalk API response message directly into HTML without proper sanitization, allowing potential injection of arbitrary HTML or JavaScript. This vulnerability is mitigated by the fact that an attacker must be able to influence the CleanTalk cloud API response (e.g., through a man-in-the-middle attack or a compromised API server). Solution: Install the latest version: * If you use the Anti-Spam by CleanTalk module for Drupal upgrade to Anti-Spam by CleanTalk 9.7.1 [3] Reported By: * Ra Mänd (ram4nd) [4] provisional member of the Drupal Security Team Fixed By: * alexandergull [5] * anton1211 [6] * Ra Mänd (ram4nd) [7] provisional member of the Drupal Security Team Coordinated By: * Neil Drumm (drumm) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185105-cleantalk-security/-/work_items/1 [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/cleantalk [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cleantalk/releases/9.7.1 [4] https://www.drupal.org/u/ram4nd [5] https://www.drupal.org/u/alexandergull [6] https://www.drupal.org/u/anton1211 [7] https://www.drupal.org/u/ram4nd [8] https://www.drupal.org/u/drumm [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://git.drupalcode.org/security/185105-cleantalk-security/-/work_items/1 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041
by security-news＠drupal.org 03 Jun '26

03 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-041 Project: Commerce Core [1] Date: 2026-June-03 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Affected versions: >= 3.3.0 < 3.3.6 CVE IDs: CVE-2026-10769 Description: The module doesn't sufficiently sanitize customer comments in the order receipt email template; this could be exploited to achieve Cross-site Scripting (XSS). This vulnerability is mitigated by the fact that it only affects installations with Checkout (commerce_checkout) enabled, and the "Comments" checkout pane (id: customer_comments) is explicitly used, which is disabled by default. Solution: Install the latest version: * If you use Commerce Core 3.3.x, upgrade to Commerce Core 3.3.6 [3] Reported By: * Brian Willows (hsjbrianwillows) [4] Fixed By: * Jonathan Sacksick (jsacksick) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Lee Rowlands (larowlan) [7] of the Drupal Security Team * Dave Long (longwave) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185078-commerce-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce/releases/3.3.6 [4] https://www.drupal.org/u/hsjbrianwillows [5] https://www.drupal.org/u/jsacksick [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/longwave [9] https://www.drupal.org/u/poker10 [10] https://git.drupalcode.org/security/185078-commerce-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

TacJS - Moderately critical - Improper Access Control - SA-CONTRIB-2026-040
by security-news＠drupal.org 03 Jun '26

03 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-040 Project: TacJS [1] Date: 2026-June-03 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Improper Access Control Affected versions: <6.8 CVE IDs: CVE-2026-49977 Description: This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup inside of content leading to an attacker being able to delete arbitrary cookies. This vulnerability is mitigated by the fact that an attacker needs to be able to insert specific data attributes in the page. Solution: Install the latest version: * If you use tacjs 8.x-6.x, upgrade to tacjs 8.x-6.8 [3] Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185107-tacjs-security/-/work_items/1 [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/tacjs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tacjs/releases/8.x-6.8 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/prudloff [8] https://git.drupalcode.org/security/185107-tacjs-security/-/work_items/1 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039
by security-news＠drupal.org 03 Jun '26

03 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-039 Project: LocalGov Workflows [1] Date: 2026-June-03 Security risk: *Moderately critical* 14 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information disclosure Affected versions: <1.6.0 CVE IDs: CVE-2026-10768 Description: This module configures default editorial workflows for LocalGov Drupal content types. It provides a Drupal content moderation workflow, a content approvals dashboard, content scheduling and content preview. The module doesn't sufficiently restrict access to a view of Service Contacts at which exposes the names and content items assigned to each Service Contact. Solution: Install the latest version: * If you use the LocalGov Workflows module for Drupal, upgrade to LocalGov Workflows 1.6.0 [3] Reported By: * Maria Young (maria.y) [4] Fixed By: * Finn Lewis (finn lewis) [5] * Rupert Jabelman (rupertj) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Dave Long (longwave) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185130-localgov_workflows-security/-/wo… [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/localgov_workflows [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/localgov_workflows/releases/1.6.0 [4] https://www.drupal.org/u/mariay-0 [5] https://www.drupal.org/u/finn-lewis [6] https://www.drupal.org/u/rupertj [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/longwave [9] https://www.drupal.org/u/poker10 [10] https://git.drupalcode.org/security/185130-localgov_workflows-security/-/wo… [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0