Drupal Security Advisories

Branch	Latest safe version	Security support until
11.4	11.4.12	Jul 7, 2027
11.3	11.3.21	Dec 16, 2026
10.6	10.6.21	Dec 16, 2026

critical Drupal · May 20, 2026 · Reviewed Nov 3

Allows SQL injection in Drupal core from 8.9.0 up to the fixed 10.4, 10.5, 10.6, 11.1, 11.2 and 11.3 releases.

Fixed in 11.3.10 and 10.6.9 · 4 older releases

medium Drupal · May 20, 2026 · Reviewed Nov 7

Drupal 11.3 CKEditor 5: Stored XSS Through Link Entity Suggestions

Lets a malicious user store scripts that run in another user's browser through CKEditor 5's entity suggestions when adding a link.

Fixed in 11.3.7

medium Drupal · May 20, 2026 · Reviewed Nov 7

Drupal Core: Cross-Site Scripting Through AJAX Modal Dialog Options

Can let an attacker run scripts in a visitor's browser because Drupal's jQuery AJAX modal dialog code doesn't sanitize some options.

Fixed in 11.3.7 and 10.6.7 · 2 older releases

medium Drupal · May 20, 2026 · Reviewed Nov 7

Drupal Core: Gadget Chain Can Turn Another Unserialize Bug Into Code Execution

Gives attackers a path to code execution or SQL injection on Drupal sites that already have another flaw passing untrusted data to unserialize().

Fixed in 11.3.7 and 10.6.7 · 2 older releases

low Drupal · Nov 18, 2025 · Reviewed Nov 8

Drupal Core: Private Files Can Be Cached and Served to Other Users

Can leak private files through Varnish or a CDN on Drupal sites that serve non-public files through a module adding its own file scheme.

Only affects branches that no longer get security fixes

low Drupal · Nov 18, 2025 · Reviewed Nov 8

Drupal Core: Crafted Links Can Show Visitors a Defaced Page

Lets an attacker show a defaced page to anyone they trick into opening a crafted link to a Drupal site. Nothing is stored on the site.

Only affects branches that no longer get security fixes

low Drupal · Nov 18, 2025 · Reviewed Nov 8

Drupal Core: Request Overrides Can Poison the Page Cache

Lets an anonymous attacker make Drupal cache the wrong response, so later visitors get broken or unstyled pages.

Only affects branches that no longer get security fixes

medium Drupal · Nov 18, 2025 · Reviewed Nov 8

Drupal Core: Gadget Chain Could Turn an Unserialize Bug Into Code Execution

Gives an attacker a path to run code on a Drupal site, but only if a separate flaw already lets them pass untrusted data to unserialize().

Only affects branches that no longer get security fixes

medium Drupal · Apr 1, 2025 · Reviewed Nov 8

Drupal Core: Unfiltered Error Messages Allow Reflected XSS

Lets an attacker run script in a visitor's browser on a Drupal site by getting them to open a crafted link.

Only affects branches that no longer get security fixes

medium Drupal · Apr 1, 2025 · Reviewed Nov 8

Drupal Core: Gadget Chain Could Let an Unserialize Bug Include Files

Gives an attacker a path to include files, and possibly run code, on a Drupal site, but only if another flaw lets them pass data to unserialize().

Only affects branches that no longer get security fixes

low Drupal · Apr 1, 2025 · Reviewed Nov 8

Drupal Core Link Fields: Unsanitized Attributes Allow XSS

Lets a user who can set Link field attributes run script in other visitors' browsers on Drupal sites that use Link fields.

Only affects branches that no longer get security fixes

medium Drupal · Apr 1, 2025 · Reviewed Nov 8

Drupal Core: Bulk Actions Let Users Publish Content Without Permission

Lets users who can reach /admin/content and edit nodes publish, unpublish, promote or make content sticky without permission to do so.

Only affects branches that no longer get security fixes

high Drupal · Dec 10, 2024

Drupal core contains a potential PHP Object Injection vulnerability

Only affects branches that no longer get security fixes

medium Drupal · Dec 10, 2024 · Reviewed Nov 9

Drupal Core: Users Can Register With an Email Address Already in Use

Lets a user sign up with an email address another account already has, written in different letter case, on some Drupal database setups.

Only affects branches that no longer get security fixes

medium Drupal · Dec 10, 2024 · Reviewed Nov 9

Drupal Core: Ajax Status Messages Can Run Injected Scripts

Lets a logged-in user get script into status messages that Drupal renders with JavaScript, in some site configurations.

Only affects branches that no longer get security fixes

high Drupal · Dec 5, 2024 · Reviewed Nov 9

Drupal Comment Module: Crafted Reply Requests Can Take a Site Down

Lets an attacker cause a denial of service with comment reply requests on Drupal sites that use the core Comment module.

Only affects branches that no longer get security fixes

medium Drupal · Dec 5, 2024 · Reviewed Nov 9

Drupal CKEditor 5: Some Image Uploads Can Move the Whole Webroot

Lets a malicious user take a Drupal 10 site offline through a CKEditor 5 image upload, on sites with several uncommon settings combined.

Only affects branches that no longer get security fixes

medium Drupal · Aug 29, 2024 · Reviewed Nov 10

Drupal Core: Error Pages Can Reveal the Site's Full Server Path

Can show anyone the full server path of a Drupal site when settings.php raises a PHP error on pages like core/authorize.php.

Only affects branches that no longer get security fixes

medium Drupal · Jan 17, 2024

Drupal core - Moderately critical - Denial of Service

Only affects branches that no longer get security fixes

medium Drupal · Jan 16, 2024 · Reviewed Nov 10

Drupal Core 9.3.6: Denial of Service Reported in an End-of-Life Release

Lets an attacker cause a denial of service on Drupal 9.3.6, per JPCERT; Drupal could not reproduce it on 9.5.x or the 10 series.

No fixed release listed yet

critical Drupal · Sep 28, 2023 · Reviewed Nov 10

Drupal JSON:API: Cached Error Backtraces Can Expose Data to Anonymous Users

Can cache error backtraces with sensitive data and serve them to anonymous users on Drupal sites with the JSON:API module enabled.

Only affects branches that no longer get security fixes

critical Drupal · Apr 26, 2023

Access bypass in Drupal core

Only affects branches that no longer get security fixes

high Drupal · Apr 26, 2023

Improper input validation in Drupal core

Only affects branches that no longer get security fixes

medium Drupal · Apr 26, 2023

Lack of domain validation in Druple core

Only affects branches that no longer get security fixes

high Drupal · Jul 20, 2022

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2022-014

Only affects branches that no longer get security fixes

high Drupal · Jul 20, 2022

Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012

Only affects branches that no longer get security fixes

medium Drupal · Jul 20, 2022

Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013

Only affects branches that no longer get security fixes

medium Drupal · May 24, 2022

Drupal Core Cross-site scripting vulnerability

Only affects branches that no longer get security fixes

high Drupal · May 17, 2022

Drupal Access Control Bypass

Only affects branches that no longer get security fixes

medium Drupal · May 17, 2022

Drupal Open Redirect

Only affects branches that no longer get security fixes

critical Drupal · Apr 22, 2022

Drupal SQL Injection vulnerability

No fixed release listed yet

medium Drupal · Apr 22, 2022

Drupal Cross-Site Scripting vulnerability

No fixed release listed yet

high Drupal · Feb 18, 2022

Improper input validation in Drupal core

Only affects branches that no longer get security fixes

medium Drupal · Feb 18, 2022

Incorrect authorization in Drupal core

Only affects branches that no longer get security fixes

critical Drupal · Feb 12, 2022

Unrestricted Upload of File with Dangerous Type in Drupal core

Only affects branches that no longer get security fixes

medium Drupal · Feb 12, 2022

Cross-Site Request Forgery in Drupal core

Only affects branches that no longer get security fixes

high Drupal · Feb 12, 2022

Drupal core access bypass vulnerability

Only affects branches that no longer get security fixes

medium Drupal · Feb 12, 2022

Incorrect Authorization in Drupal core

Only affects branches that no longer get security fixes

medium Drupal · May 26, 2021

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2021-005

Only affects branches that no longer get security fixes

medium Drupal · Apr 21, 2021

Drupal core - Critical - Cross-site scripting - SA-CORE-2021-003

Only affects branches that no longer get security fixes

medium Drupal · Apr 21, 2021

Drupal core - Critical - Cross-site scripting - SA-CORE-2021-002

Only affects branches that no longer get security fixes

medium Drupal · Nov 25, 2020

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013

Only affects branches that no longer get security fixes

high Drupal · Nov 18, 2020

Drupal core - Critical - Remote code execution - SA-CORE-2020-012

Only affects branches that no longer get security fixes

medium Drupal · Sep 16, 2020

Drupal core - Moderately critical - Access bypass - SA-CORE-2020-008

Only affects branches that no longer get security fixes

medium Drupal · Sep 16, 2020

Drupal core - Critical - Cross-site scripting - SA-CORE-2020-009

Only affects branches that no longer get security fixes

medium Drupal · Sep 16, 2020

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-010

Only affects branches that no longer get security fixes

medium Drupal · Sep 16, 2020

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007

Only affects branches that no longer get security fixes

high Drupal · Sep 16, 2020

Drupal core - Moderately critical - Information disclosure - SA-CORE-2020-011

Only affects branches that no longer get security fixes

high Drupal · Jun 17, 2020

Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004

Only affects branches that no longer get security fixes

high Drupal · Jun 17, 2020

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-005

Only affects branches that no longer get security fixes

critical Drupal · Jun 17, 2020

Drupal core - Less critical - Access bypass - SA-CORE-2020-006

Only affects branches that no longer get security fixes

medium Drupal · May 20, 2020

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002

Only affects branches that no longer get security fixes

medium Drupal · May 20, 2020

Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003

Only affects branches that no longer get security fixes

medium Drupal · Mar 18, 2020

Drupal core - Moderately critical - Third-party library - SA-CORE-2020-001

Only affects branches that no longer get security fixes

critical Drupal · Dec 18, 2019

Drupal core - Moderately critical - Access bypass - SA-CORE-2019-011

Only affects branches that no longer get security fixes

critical Drupal · Dec 18, 2019

Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009

Only affects branches that no longer get security fixes

medium Drupal · Dec 18, 2019

Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012

Only affects branches that no longer get security fixes

medium Drupal · Dec 18, 2019

Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2019-010

Only affects branches that no longer get security fixes

critical Drupal · Jul 16, 2019

Critical - Access bypass

Only affects branches that no longer get security fixes

critical Drupal · May 8, 2019

Moderately critical - Third-party libraries - SA-CORE-2019-007

Only affects branches that no longer get security fixes

medium Drupal · Mar 20, 2019

Moderately critical - Cross Site Scripting - SA-CORE-2019-004

Only affects branches that no longer get security fixes

high Drupal · Feb 20, 2019

Highly critical - Remote Code Execution

Only affects branches that no longer get security fixes

high Drupal · Jan 15, 2019 · Reviewed Nov 7

Critical - Third Party Libraries

Only affects branches that no longer get security fixes

critical Drupal · Jan 15, 2019

Critical - Arbitrary PHP code execution

Only affects branches that no longer get security fixes

high Drupal · Oct 17, 2018

Content moderation - Moderately critical - Access bypass

Only affects branches that no longer get security fixes

medium Drupal · Oct 17, 2018

Contextual Links validation - Critical - Remote Code Execution

Only affects branches that no longer get security fixes

high Drupal · Oct 17, 2018

Anonymous Open Redirect - Moderately Critical - Open Redirect

Only affects branches that no longer get security fixes

medium Drupal · Oct 17, 2018

External URL injection through URL aliases - Moderately Critical - Open Redirect

Only affects branches that no longer get security fixes

medium Drupal · Oct 17, 2018

Injection in DefaultMailSystem::mail() - Critical - Remote Code Execution

Only affects branches that no longer get security fixes

critical Drupal · Apr 25, 2018

Critical - Remote Code Execution

Only affects branches that no longer get security fixes

medium Drupal · Apr 18, 2018

Moderately critical - Cross Site Scripting

Only affects branches that no longer get security fixes

critical Drupal · Mar 28, 2018

Highly critical - Remote Code Execution

Only affects branches that no longer get security fixes

medium Drupal · Feb 20, 2018

JavaScript cross-site scripting prevention is incomplete.

Only affects branches that no longer get security fixes

high Drupal · Feb 20, 2018

Comment reply form allows access to restricted content.

Only affects branches that no longer get security fixes

medium Drupal · Feb 20, 2018

External link injection on 404 pages when linking to the current page.

Only affects branches that no longer get security fixes

high Drupal · Feb 20, 2018

Language fallback can be incorrect on multilingual sites with node access restrictions.

Only affects branches that no longer get security fixes

medium Drupal · Feb 20, 2018

Settings Tray access bypass.

Only affects branches that no longer get security fixes

medium Drupal · Feb 20, 2018

Private file access bypass.

Only affects branches that no longer get security fixes

medium Drupal · Feb 20, 2018

jQuery vulnerability with untrusted domains.

Only affects branches that no longer get security fixes

medium Drupal · Aug 16, 2017

Views does not properly restrict access to the Ajax endpoint.

Only affects branches that no longer get security fixes

high Drupal · Aug 16, 2017

REST API can bypass comment approval.

Only affects branches that no longer get security fixes

critical Drupal · Aug 16, 2017

Entity access bypass for entities that do not have UUIDs or have protected revisions.

Only affects branches that no longer get security fixes

medium Drupal · Jun 21, 2017

File REST resource does not properly validate

Only affects branches that no longer get security fixes

medium Drupal · Jun 21, 2017

Files uploaded by anonymous users into a private file system can be accessed by other anonymous users

Only affects branches that no longer get security fixes

critical Drupal · Jun 21, 2017

PECL YAML parser unsafe object handling

Only affects branches that no longer get security fixes

high Drupal · Apr 19, 2017

Access bypass

Only affects branches that no longer get security fixes

high Drupal · Mar 15, 2017

Editor module incorrectly checks access to inline private files

Only affects branches that no longer get security fixes

high Drupal · Mar 15, 2017

Some admin paths were not protected with a CSRF token

Only affects branches that no longer get security fixes

high Drupal · Mar 15, 2017

Remote code execution

Only affects branches that no longer get security fixes

high Drupal · Nov 16, 2016

Incorrect cache context on password reset page

Only affects branches that no longer get security fixes

medium Drupal · Nov 16, 2016

Denial of service via transliterate mechanism

Only affects branches that no longer get security fixes

medium Drupal · Nov 16, 2016

Inconsistent name for term access query

Only affects branches that no longer get security fixes

medium Drupal · Sep 21, 2016

Users without "Administer comments" can set comment visibility on nodes they can edit

Only affects branches that no longer get security fixes

medium Drupal · Sep 21, 2016

Full config export can be downloaded without administrative permissions

Only affects branches that no longer get security fixes

medium Drupal · Sep 21, 2016

Cross-site Scripting in http exceptions

Only affects branches that no longer get security fixes

high Drupal · Jun 15, 2016

Saving user accounts can sometimes grant the user all roles

Only affects branches that no longer get security fixes

medium Drupal · Jun 15, 2016

Views can allow unauthorized users to see Statistics information

Only affects branches that no longer get security fixes

medium Drupal · Feb 15, 2016

HTTP header injection using line breaks

Only affects branches that no longer get security fixes

high Drupal · Feb 15, 2016

Open redirect via path manipulation

Only affects branches that no longer get security fixes

medium Drupal · Feb 15, 2016

Reflected file download vulnerability

Only affects branches that no longer get security fixes

high Drupal · Feb 15, 2016

Session data truncation can lead to unserialization of user provided data

Only affects branches that no longer get security fixes

high Drupal · Feb 15, 2016

File upload access bypass and denial of service

Only affects branches that no longer get security fixes

high Drupal · Feb 15, 2016

Open redirect via double-encoded 'destination' parameter

Only affects branches that no longer get security fixes

high Drupal · Feb 15, 2016

Saving user accounts can sometimes grant the user all roles

Only affects branches that no longer get security fixes

high Drupal · Feb 15, 2016

Form API ignores access restrictions on submit buttons

Only affects branches that no longer get security fixes

medium Drupal · Feb 15, 2016

Email address can be matched to an account

Only affects branches that no longer get security fixes

high Drupal · Feb 15, 2016

Brute force amplification attacks via XML-RPC

Only affects branches that no longer get security fixes

Drupal security advisories

Supported branches

Check your version

All Drupal advisories