Drupal security updates, in plain English

Week of 11 February 2026

Drupal publishes security updates on Wednesdays. This week there were 2, all for modules.

None for Drupal core, so nothing here applies to every site.

Each card says what the module does, what went wrong, who could do it, whether it applies to you, how urgent it is, and the one line to send to your developer. Worst rated first, and most used first within a rating.

New here? How Drupal security updates work explains who publishes these, why they matter and what the ratings mean. Earlier weeks and a search by module are on the main page.

Critical: 1 update

Cyber Essentials expects a fix within 14 days. Do it this week.

UI Icons

Critical · 10,938 sites report using it · SA-CONTRIB-2026-010 · on drupal.org

This module allows a website to manage and display small graphics or icons.

The module fails to clean up text provided by visitors. Anyone visiting the site could use this flaw to view private information. They could also alter or add new information to the website.

Who could do thisAnyone visiting the site. No login needed.
Does it apply to youThis applies if the site has enabled the UI Icons for CKEditor 5 feature.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.

Tell your developerUpdate UI Icons to 1.0.1 or 1.1.1, whichever branch you are on.

For developers: what the fix changed

Removes the unsanitised icon ID from the 404 response in IconFilterController to prevent reflected cross site scripting.

1.0.0 to 1.0.1 1 commit, 1 file.

modules/ui_icons_ckeditor5/src/Controller/IconFilterController.php +1 −1 fix

Full diff, 1.0.0 to 1.0.1 · Full diff, 1.1.0 to 1.1.1

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Moderately critical: 1 update

Include in your next routine update, within the month.

Quick Edit

Moderately critical · 36,982 sites report using it · SA-CONTRIB-2026-009 · on drupal.org

This module allows people to edit content directly on the page they are viewing.

The module does not properly clean up details about images when someone edits a page. A person with a standard account could use this to view private information. They could also change existing details or add new information to the site.

Who could do thisOnly someone with a login on your site.
Does it apply to youThis applies if a user has the access right to create or edit an affected piece of content.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Quick Edit to 2.0.1 or 1.0.5, whichever branch you are on.

For developers: what the fix changed

The fix wraps the `settings.alt` and `settings.title` values with `Drupal.checkPlain()` in the image editing dialog templates within `js/theme.es6.js`, `js/theme.image.es6.js`, and their compiled counterparts. This ensures the values are properly sanitised to prevent cross-site scripting.

Also in this release The release also updated the GitLab CI configuration to remove a spellcheck ignore paths variable.

2.0.0 to 2.0.1 2 commits, 5 files.

.gitlab-ci.yml +0 −1
js/theme.es6.js +6 −6 fix
js/theme.image.es6.js +4 −4 fix
js/theme.image.js +3 −3 fix
js/theme.js +3 −3 fix

Full diff, 2.0.0 to 2.0.1 · Full diff, 1.0.4 to 1.0.5

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Not sure what your site is running?

Send me your Drupal site's address.

I'll tell you what I can see from outside, what the Drupal 10 end of life on 9 December means for it, and what it would cost to have me keep it patched. There's no charge for that and no obligation. peter@peterbrady.co.uk

Compiled 10 October 2026 as part of the archive back to January 2026, from the advisories published by the Drupal security team on drupal.org. The facts on each card are theirs. The plain English is mine, with help from a language model. In the archive the cards rated critical or above were read before publishing and the rest were checked by sampling. Install counts are today's, not the count on the day of the advisory.