Highly critical · no install count published · SA-CONTRIB-2026-220 · on drupal.org
This module allows a website to process and convert standard and animated images.
The module does not properly filter file names before processing uploaded images. Someone could use this flaw to view any private information or modify any code on the website. There is no data on the website that they could not read or change.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youThis applies if a person has the ability to upload images to the website.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this highly critical. Cyber Essentials expects a fix within 14 days. Do it this week.
Tell your developerUpdate Ffmpeg Image Toolkit to 1.0.3.
For developers: what the fix changed
The fix applies escapeshellarg to sanitise the input and output file paths in the Ffmpeg class within src/Ffmpeg.php.
1.0.2 to 1.0.3 1 commit, 1 file.
Full diff, 1.0.2 to 1.0.3
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Critical · 12,471 sites report using it · 2 security fixes
This module provides a way for website administrators to choose and set up icons across different parts of a website.
2 security fixes in one update. UI Icons fixed 2 separate security bugs at once: 2 cross site scripting. One update covers all of them. The most serious, SA-CONTRIB-2026-221, is explained here and the full list is at the end of the card.
The module does not check the icon settings provided by users before displaying them on the screen. Someone could use this to view restricted content or modify certain data on the page. They could not access the entire database or alter the core website files.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.
Tell your developerUpdate UI Icons to 2.0.2 or 1.1.3, whichever branch you are on.
For developers: what the fix changed
This release carries 2 security fixes. The summary below is for SA-CONTRIB-2026-221, the most serious of them.
The fix introduces a new `IconSettings::filter()` method in `src/IconSettings.php` to restrict icon settings provided by users to only scalar values declared by the icon pack. This filter is applied across various components including `IconFilterController`, `IconEmbed`, `IconPreviewController`, and `IconAutocomplete`, while `iconEditing.js` is updated to escape missing icon IDs in the CKEditor preview.
Also in this release The release also updates tests in `IconAutocompleteUnitTest.php`.
2.0.1 to 2.0.2 4 commits, 8 files including 1 test.
modules/ui_icons_ckeditor5/js/build/icon.js +1 −1 fixmodules/ui_icons_ckeditor5/js/ckeditor5_plugins/icon/src/iconEditing.js +1 −1 fixmodules/ui_icons_ckeditor5/src/Controller/IconFilterController.php +2 −0 fixmodules/ui_icons_text/src/Plugin/Filter/IconEmbed.php +4 −2 fixsrc/Controller/IconPreviewController.php +7 −1 fixsrc/Element/IconAutocomplete.php +3 −1 fixsrc/IconSettings.php +44 −0 fix
Full diff, 2.0.1 to 2.0.2 · Full diff, 1.1.2 to 1.1.3
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
All 2 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.
Critical · 3,157 sites report using it · SA-CONTRIB-2026-225 · on drupal.org
This module allows users to easily create custom field formatters through an admin interface without writing a custom module.
The formatter engine runs a function to execute user provided PHP code and allows arbitrary PHP execution on the site. An administrator account could view any private data on the site and alter any data on the site, including the underlying code.
- Who could do thisOnly someone with an administrator login.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.
Tell your developerUpdate Custom Formatters to 4.2.1.
For developers: what the fix changed
The fix introduces granular permissions for custom formatters, adding restricted permissions for creating and editing PHP and Twig formatters in custom_formatters.permissions.yml and enforcing them via FormatterAccessControlHandler.php. It also updates the routing requirements and plugin definitions to use these new permissions.
Also in this release The release branch was updated to 4.2.x in CI and documentation files, and the changelog was updated.
4.2.0 to 4.2.1 2 commits, 12 files.
CHANGELOG.md +28 −0README.md +8 −5codecov.yml +1 −1custom_formatters.module +2 −2 fixcustom_formatters.permissions.yml +29 −1 fixcustom_formatters.routing.yml +3 −3 fixsrc/Annotation/FormatterType.php +13 −0 fixsrc/Attribute/FormatterType.php +7 −0 fixsrc/Controller/CustomFormattersController.php +8 −3 fixsrc/FormatterAccessControlHandler.php +92 −3 fixsrc/Plugin/CustomFormatters/FormatterType/Php.php +7 −5 fixsrc/Plugin/CustomFormatters/FormatterType/Twig.php +9 −0 fix
Full diff, 4.2.0 to 4.2.1
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Critical · Theme · 1,909 sites report using it · SA-CONTRIB-2026-222 · on drupal.org
This theme provides a clean design and layout options for a website.
The theme does not properly filter the text of menu link titles before putting them into the website code. A person could exploit this to see hidden details or change certain information on the site. They could not read all private data or change the underlying code.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youThis applies if a person has the access right to create or edit menu link titles.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.
Tell your developerUpdate Zero Point to 2.0.1 or 8.x-1.30, whichever branch you are on.
For developers: what the fix changed
The provided diff does not contain the fix for the XSS vulnerability, as the changes to the menu templates or preprocess functions where the sanitisation would occur are missing.
The fix is not clearly separable from the other changes in this release, so treat the summary above as a pointer rather than a finding.
Also in this release The release updated default configuration, removed some custom layout examples, and made extensive CSS changes for components like navigation, forms, and messages.
2.0.0 to 2.0.1 2 commits, 122 files.
CHANGELOG.txt +16 −0REVIEW.md +0 −65Readme.md +0 −0_custom/README.txt +10 −12_custom/example.custom-style.css +0 −0_custom/optional-layouts.html +0 −65config/install/zeropoint.settings.yml +69 −5config/schema/zeropoint.schema.yml +33 −37css/_cart.css +25 −9css/_font-merriweather.css +11 −6css/_font-montserrat.css +11 −6css/_font-open-sans.css +9 −4
Full diff, 2.0.0 to 2.0.1 · Full diff, 8.x-1.29 to 8.x-1.30
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Critical · Theme · 213 sites report using it · SA-CONTRIB-2026-224 · on drupal.org
This theme provides configurable layouts and visual styling for Drupal websites.
The theme does not sufficiently sanitise menu link titles before inserting them into HTML class attributes. Anyone with no login could view restricted information and alter or add new data by injecting malicious scripts.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAn attacker must be able to create or modify menu link titles.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.
Tell your developerUpdate ABC to 8.x-1.25 or 2.0.1, whichever branch you are on.
For developers: what the fix changed
The fix updates `preprocessMenu` and introduces `prepareMenuTitles` in `src/Hook/AbcHooks.php` to strictly validate Font Awesome class names using a regular expression and escape the menu link title using `Html::escape()` before inserting it into the HTML class attribute.
Also in this release The release also fixes multilingual slide URLs, custom CSS file path resolution, and filters unsafe protocols in social links.
8.x-1.24 to 8.x-1.25 1 commit, 15 files.
CHANGELOG.txt +15 −0abc.info.yml +74 −75src/Hook/AbcHooks.php +164 −14 fixtemplates/content/comment.html.twig +1 −0templates/content/node--article.html.twig +5 −4templates/content/node--blog-post.html.twig +5 −4templates/content/node--book.html.twig +5 −4templates/content/node--forum.html.twig +4 −3templates/content/node--page.html.twig +5 −4templates/content/node.html.twig +5 −4templates/includes/slider.html.twig +21 −21templates/includes/social_links.html.twig +15 −15
Full diff, 8.x-1.24 to 8.x-1.25 · Full diff, 2.0.0 to 2.0.1
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Critical · Theme · 177 sites report using it · SA-CONTRIB-2026-223 · on drupal.org
This theme provides a dark design with customisation options for the layout and visual style of a website.
The theme fails to clean up the text used for menu link titles before adding them to the page code. Someone could use this flaw to view restricted information or alter parts of the website. They could not take full control of the website or read every piece of private data.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youThis applies if a person has the access right to create or edit menu link titles.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.
Tell your developerUpdate Black Hole to 2.0.1 or 8.x-1.26, whichever branch you are on.
For developers: what the fix changed
The diff does not appear to contain the fix for the XSS vulnerability, as the changes to the PHP and Twig files where menu link titles would be sanitised are missing.
The fix is not clearly separable from the other changes in this release, so treat the summary above as a pointer rather than a finding.
Also in this release The release updated theme configuration, bundled CSS files, and documentation, and added new layout and styling options.
2.0.0 to 2.0.1 2 commits, 125 files.
CHANGELOG.txt +20 −2Readme.md +0 −0_custom/README.txt +11 −14_custom/example.custom-style.css +0 −0_custom/optional-layouts.html +0 −65black_hole.info.yml +1 −0black_hole.libraries.yml +101 −139config/install/black_hole.settings.yml +69 −5config/schema/black_hole.schema.yml +33 −37css/_cart.css +25 −10css/_font-merriweather.css +11 −6css/_font-montserrat.css +11 −6
Full diff, 2.0.0 to 2.0.1 · Full diff, 8.x-1.25 to 8.x-1.26
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Critical · 81 sites report using it · SA-CONTRIB-2026-227 · on drupal.org
This module provides functionality for selecting and working with Webforms.
The module does not perform sufficient access checking for pieces of content in some cases and may expose the title of private Webforms. Anyone with no login could view the titles of these private forms. They could not alter any forms.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.
Tell your developerUpdate Dopup to 1.0.7.
For developers: what the fix changed
The fix updates the autocomplete route in dopup.routing.yml to require the administer webform permission and enables entity access checking in the webform query within DopupAutoCompleteController::build.
1.0.6 to 1.0.7 1 commit, 2 files.
dopup.routing.yml +1 −1 fixsrc/Controller/DopupAutoCompleteController.php +1 −1 fix
Full diff, 1.0.6 to 1.0.7
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Critical · 14 sites report using it · SA-CONTRIB-2026-253 · on drupal.org
This module enables you to create one or more multisites with highly detailed page access rights.
When the input of the content creation form is processed, it makes use of a PHP function in an unsafe way. An ordinary account on the site could read any private information on the site. They could also alter any data on the site, including the underlying code.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youThe RSS Page submodule must be enabled and an attacker must have a role with the access right to create new RSS feed content.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.
Tell your developerUpdate Monster Menus to 9.5.6.
For developers: what the fix changed
The fix removes the use of the unserialize function on user input in the RSSFeedList class within modules/rss_page/src/Element/RSSFeedList.php.
9.5.5 to 9.5.6 1 commit, 1 file.
modules/rss_page/src/Element/RSSFeedList.php +5 −14 fix
Full diff, 9.5.5 to 9.5.6
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · Theme · 91,201 sites report using it · SA-CONTRIB-2026-236 · on drupal.org
This theme provides the Bootstrap front end framework as a Drupal design.
The theme did not sufficiently filter certain attributes which could lead to a vulnerability where malicious scripts are run. An ordinary account on the site could view restricted information and alter or add new data through these scripts.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youThe optional tooltip and popover features must be enabled.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Bootstrap to 8.x-3.45.
For developers: what the fix changed
The fix removes `sanitize`, `sanitizeFn`, and `whiteList` properties from the element's data attributes before passing them as options to the Bootstrap popover and tooltip plugins in `js/popover.js` and `js/tooltip.js`, preventing attackers from bypassing the sanitizer.
Also in this release The release also updates the Bootstrap library version from 3.4.9 to 3.4.10 and adds automated tests for the new sanitizer behaviour.
8.x-3.44 to 8.x-3.45 1 commit, 14 files including 2 tests.
docs/Theme-Settings.md +10 −10js/popover.js +8 −1 fixjs/tooltip.js +8 −1 fixsrc/Bootstrap.php +2 −1src/Plugin/Provider/ApiProviderBase.php +4 −3src/Plugin/Provider/CdnAsset.php +4 −3src/Plugin/Provider/DrupalBootstrapStyles.php +1 −0src/Plugin/Setting/Advanced/Cdn/CdnCustom.php +6 −6src/Plugin/Setting/Advanced/Cdn/CdnCustomCss.php +1 −1src/Plugin/Setting/Advanced/Cdn/CdnCustomCssMin.php +1 −1src/Plugin/Setting/Advanced/Cdn/CdnCustomJs.php +1 −1src/Plugin/Setting/Advanced/Cdn/CdnCustomJsMin.php +1 −1
Full diff, 8.x-3.44 to 8.x-3.45
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 74,799 sites report using it · SA-CONTRIB-2026-252 · on drupal.org
This module lets site builders control what happens when a piece of content is viewed, such as showing it, returning an access denied response, or redirecting the visitor to another web address.
A visitor could view content a site had configured to hide or avoid a configured redirect. Anyone with no login could alter the settings that hide a piece of content. They could not read the hidden content itself.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youThe first vulnerability affects every site that relies on this module to deny access to or hide content, and the second affects sites where an attacker has a role with the access right to edit the affected content and the site exposes a write path that bypasses the content form such as a data feed with writes enabled.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Rabbit Hole to 8.x-1.3 or 2.0.0-beta3, whichever branch you are on.
For developers: what the fix changed
The fix prevents query parameters from overriding internal request attributes by using `$request->attributes->get()` instead of `$request->get()` in `src/BehaviorInvoker.php`. It also implements `hook_entity_field_access()` in `rabbit_hole.module` to enforce the administer permission on Rabbit Hole fields, preventing unauthorised modification via APIs like JSON:API or REST.
Also in this release The release also adds cacheability metadata to redirect responses, removes settings from confirmation forms, encodes redirect paths exactly once, fixes a schema mismatch, and populates empty values with defaults.
8.x-1.2 to 8.x-1.3 7 commits, 29 files including 11 tests.
config/install/rabbit_hole.behavior_settings.default.yml +2 −2config/install/rabbit_hole.behavior_settings.default_bundle.yml +2 −2config/schema/behavior_settings.schema.yml +3 −1modules/rh_node/rh-node.js +2 −1rabbit_hole.install +102 −0rabbit_hole.module +54 −2 fixrabbit_hole.permissions.yml +1 −1rabbit_hole.post_update.php +17 −1src/BehaviorInvoker.php +37 −5 fixsrc/BehaviorInvokerInterface.php +1 −1src/BehaviorSettingsManager.php +1 −1src/EntityExtender.php +1 −0
Full diff, 8.x-1.2 to 8.x-1.3 · Full diff, 8.x-1.3 to 2.0.0-beta3
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 72,852 sites report using it · SA-CONTRIB-2026-235 · on drupal.org
This module allows granting access to unpublished pieces of content per content type.
For pieces of content with at least one unpublished translation, the module grants every user with the access content access right view access to the published translations of that piece of content. Anyone with no login could view published translations they should not be able to see. They could not alter any translations.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youThe site must be multilingual, a piece of content must have both unpublished and published translations, and another access module must restrict view access to the published translations.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate View Unpublished to 8.x-1.5.
For developers: what the fix changed
Implements `hook_node_access_records_alter()` in `view_unpublished.module` to remove the `view_unpublished_published_content` grant if other modules provide grant records for the node, preventing it from overriding their access restrictions.
Also in this release Adds a post-update hook to rebuild node access and includes automated tests.
8.x-1.4 to 8.x-1.5 1 commit, 6 files including 4 tests.
view_unpublished.module +26 −0 fixview_unpublished.post_update.php +28 −0
Full diff, 8.x-1.4 to 8.x-1.5
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 27,674 sites report using it · SA-CONTRIB-2026-248 · on drupal.org
This module enables you to protect a site behind a basic authentication prompt so that an unfinished or non public site cannot be viewed or indexed by anonymous visitors.
The module does not sufficiently limit the number of authentication attempts it will evaluate when an anonymous visitor repeatedly submits credentials. Anyone with no login could view restricted pages by guessing the password. They could not alter any information.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youThe configured credentials must be guessable and the module must be used as a supplementary barrier in front of a site.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Shield to 8.x-1.9.
For developers: what the fix changed
The fix introduces flood control to limit the rate of failed authentication attempts in `src/ShieldMiddleware.php` by checking and registering attempts using the core flood service and returning a 429 response when the limit is exceeded.
Also in this release Added a configuration setting and user interface for flood control, along with corresponding tests.
8.x-1.8 to 8.x-1.9 1 commit, 6 files including 1 test.
config/install/shield.settings.yml +1 −0config/schema/shield.schema.yml +3 −0shield.services.yml +2 −0src/Form/ShieldSettingsForm.php +12 −1src/ShieldMiddleware.php +129 −3 fix
Full diff, 8.x-1.8 to 8.x-1.9
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 27,587 sites report using it · SA-CONTRIB-2026-242 · on drupal.org
This module introduces an authorisation server which can be configured to protect your Drupal instance with access tokens.
The module could cache a token's access rights in a way that let them be reused for another user's token. An ordinary account on the site could view restricted information and alter or add new data by gaining access rights they do not have.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAn attacker needs a token and a more privileged user's token with the same scopes must be used first.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Simple OAuth (OAuth2) & OpenID Connect to 6.1.3.
For developers: what the fix changed
The fix introduces a new cache context `oauth2_subject_roles` in `src/Cache/Oauth2SubjectRolesCacheContext.php` and applies it to `DecoratedUserRolesAccessPolicy` and `Oauth2AccessPolicy` to ensure that cached permissions vary by the token subject's full roles, preventing permission leakage between users with the same scopes.
6.1.2 to 6.1.3 1 commit, 6 files including 1 test.
simple_oauth.services.yml +7 −2 fixsrc/Access/DecoratedUserRolesAccessPolicy.php +23 −5 fixsrc/Access/Oauth2AccessPolicy.php +103 −18 fixsrc/Access/TokenAuthUserResolver.php +45 −0 fixsrc/Cache/Oauth2SubjectRolesCacheContext.php +75 −0 fix
Full diff, 6.1.2 to 6.1.3
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 23,814 sites report using it · SA-CONTRIB-2026-244 · on drupal.org
This module provides a plugin that integrates a calendar view format powered by a JavaScript library.
The module allows a user to update fields on a piece of content without checking field level access. An ordinary account on the site could alter or add data to these fields. They could not view any hidden information.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAn attacker must have access to update the piece of content itself.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Fullcalendar View to 5.2.6.
For developers: what the fix changed
The fix adds a check for field level edit access and field type in `src/Controller/CalendarEventController.php` by introducing a new `isWritableDateField` method. It also adds entity validation before saving.
5.2.5 to 5.2.6 1 commit, 1 file.
src/Controller/CalendarEventController.php +70 −0 fix
Full diff, 5.2.5 to 5.2.6
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 18,194 sites report using it · SA-CONTRIB-2026-243 · on drupal.org
This module enables users to upload files and create media items in bulk.
The module does not sufficiently check user access rights to create specific media types if the bulk upload form is configured for that media type. An ordinary account on the site could alter or add new media items. They could not view any restricted information.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAn attacker must have a role with the bulk upload form access right.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Media Bulk Upload to 3.0.6.
For developers: what the fix changed
The fix adds checks to ensure the user has permission to create specific media types. This is implemented in `MediaBulkUploadController::accessForm` to verify if the user can create any of the configured media types, and in `MediaBulkUploadForm` to filter allowed extensions and validate permissions during file processing.
Also in this release Added GitLab CI, updated documentation, defined a canonical route for media bulk config, and improved code formatting.
3.0.5 to 3.0.6 5 commits, 28 files.
.cspell-project-words.txt +6 −0.gitlab-ci.yml +33 −0README.md +20 −29composer.json +2 −2config/schema/media_bulk_config.schema.yml +1 −1media_bulk_upload.info.yml +1 −1media_bulk_upload.install +7 −2media_bulk_upload.links.contextual.yml +1 −1media_bulk_upload.links.menu.yml +5 −5media_bulk_upload.links.task.yml +1 −1media_bulk_upload.module +3 −5media_bulk_upload.permissions.yml +2 −2
Full diff, 3.0.5 to 3.0.6
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 12,188 sites report using it · SA-CONTRIB-2026-238 · on drupal.org
This module enables you to share users and content and configuration across a group of domains from a single Drupal installation.
The module does not sufficiently check which domains a user is assigned to when the per content type grant setting is enabled. An ordinary account on the site could view restricted domain information and alter or add new content across domains.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youThe per content type grants setting must be enabled, and an attacker must have a role with the access right to edit or delete any content on assigned domains together with a per content type access right, and must be assigned to at least one domain.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Domain to 3.0.2.
For developers: what the fix changed
Fixes an access bypass in `DomainAccessNodeHooks` by ensuring that users must be assigned to at least one domain before evaluating per-bundle update or delete grants.
Also in this release The release also includes numerous bug fixes, PHPStan and CSpell corrections, test updates for Drupal 11.4, and documentation additions.
3.0.1 to 3.0.2 21 commits, 60 files including 29 tests.
.cspell-project-words.txt +3 −0README.md +1 −1docs/domain_config/index.es.md +6 −1docs/domain_config/index.fr.md +6 −1docs/domain_config/index.md +6 −1docs/index.es.md +1 −1docs/index.fr.md +1 −1docs/index.md +1 −1docs/metrics.md +248 −0domain/config/install/field.field.user.user.field_domain_admin.yml +6 −4domain/config/schema/domain.schema.yml +7 −0domain/domain.install +12 −1
Full diff, 3.0.1 to 3.0.2
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 5,417 sites report using it · SA-CONTRIB-2026-247 · on drupal.org
This module enables you to generate and serve WebP versions of images.
The module serves image responses with a public cache header for all file schemes other than the private file system. Anyone with no login could view cached versions of files with information they should not be able to access. They could not alter any files.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youThe site must serve image derivatives from a custom or temporary file scheme with access control behind a shared cache that honours the cache control header, and an attacker must know the path of a previously requested file still in cache.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate ImageAPI Optimize WebP to 2.1.2.
For developers: what the fix changed
The fix updates the ImageStyleDownloadController to only mark responses as publicly cacheable if the file scheme is public or explicitly configured as an additional public scheme in settings.
2.1.1 to 2.1.2 1 commit, 1 file.
src/Controller/ImageStyleDownloadController.php +14 −1 fix
Full diff, 2.1.1 to 2.1.2
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 4,100 sites report using it · SA-CONTRIB-2026-245 · on drupal.org
This module allows for direct viewing of a file with the web address alias.
In some cases files may be served with a public cache header when they should be uncacheable. Anyone with no login could view cached versions of files with information they should not be able to access. They could not alter any files.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youDrupal must be configured to handle non public files using a custom or contributed module providing an additional file scheme, and an attacker must know to request a file that has previously been requested by a more privileged user and is still cached.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Media Alias Display to 3.0.2 or 2.1.2, whichever branch you are on.
For developers: what the fix changed
Updates DisplayController::__invoke() in src/Controller/DisplayController.php to check file_additional_public_schemes when determining if a file response should be public or private. This ensures files that are not public are not cached.
Also in this release Adds an event subscriber to restore cache headers for media responses, updates CI configuration, and refactors tests.
3.0.1 to 3.0.2 3 commits, 8 files including 3 tests.
.gitlab-ci.yml +1 −46media_alias_display.services.yml +4 −0src/Controller/DisplayController.php +13 −0 fixsrc/EventSubscriber/MediaAliasDisplayResponseSubscriber.php +51 −0src/Response/CacheableBinaryFileResponse.php +3 −5
Full diff, 3.0.1 to 3.0.2 · Full diff, 2.1.1 to 2.1.2
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 2,810 sites report using it · SA-CONTRIB-2026-232 · on drupal.org
This module allows you to define custom attributes for a block.
The module does not sufficiently sanitise attributes against malicious scripts. An administrator account could view restricted information and alter or add new data through these custom attributes.
- Who could do thisOnly someone with an administrator login.
- Does it apply to youAn attacker must have the administer blocks access right.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Block Attributes to 2.1.0.
For developers: what the fix changed
The fix introduces strict validation for attribute names using a regular expression in BlockAttributesChecker::isAttributeAllowed and adds a filterAttributeValues method to ensure only safe attributes are rendered. It also updates ConfigForm::validateForm to enforce these rules during configuration and adds an update hook in block_attributes.install to clean up existing invalid attributes.
Also in this release Added a cspell project words file to fix a misspelt word.
2.0.1 to 2.1.0 2 commits, 5 files.
.cspell-project-words.txt +1 −0block_attributes.install +50 −0 fixblock_attributes.module +23 −4 fixsrc/BlockAttributesChecker.php +59 −3 fixsrc/Form/ConfigForm.php +14 −2 fix
Full diff, 2.0.1 to 2.1.0
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 2,386 sites report using it · 2 security fixes
This module provides a page for displaying published pieces of content in a dialog.
2 security fixes in one update. Swiper formatter fixed 2 separate security bugs at once: 1 information disclosure, 1 cross site scripting. One update covers all of them. The most serious, SA-CONTRIB-2026-233, is explained here and the full list is at the end of the card.
The page does not sufficiently verify the current user's access to the specific piece of content. Anyone with no login could view restricted content displayed in the dialog. They could not alter any content.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Swiper formatter to 3.1.0 or 2.1.2, whichever branch you are on.
For developers: what the fix changed
This release carries 2 security fixes. The summary below is for SA-CONTRIB-2026-233, the most serious of them.
Adds entity and field view access checks to the `dialog` method in `src/Controller/Dialog.php` to ensure the current user has permission to view the requested content.
Also in this release Added a CKEditor 5 submodule, updated the Swiper JS build process, added caption settings, and made various code cleanups.
3.0.1 to 3.1.0 67 commits, 99 files including 36 tests.
.cspell-project-words.txt +3 −0.eslintignore +3 −1.gitignore +5 −2.gitlab-ci.yml +5 −7README.md +4 −2composer.json +6 −1config/schema/swiper_formatter.schema.yml +71 −0css/swiper_formatter.caption.css +209 −0css/swiper_formatter.css +55 −23js/build/swiper.bundle.min.css +1 −0js/build/swiper.bundle.min.js +0 −0js/eslint.config.js +1 −4
Full diff, 3.0.1 to 3.1.0 · Full diff, 2.1.1 to 2.1.2
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
All 2 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.
Moderately critical · 1,722 sites report using it · 2 security fixes
This module enables editors to edit content directly on the rendered page.
2 security fixes in one update. Frontend Editing fixed 2 separate security bugs at once: 1 cross site request forgery (csrf), 1 access bypass. One update covers all of them. The most serious, SA-CONTRIB-2026-240, is explained here and the full list is at the end of the card.
The module does not sufficiently protect the pages used to delete and reorder paragraphs against forged requests. Anyone with no login could trick an editor into visiting a crafted link which deletes or reorders paragraphs on a piece of content using the editor's access rights. They could not view any restricted information.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youThe victim must be logged in with the access right to edit the content and to delete or move paragraphs.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Frontend Editing to 1.9.3.
For developers: what the fix changed
This release carries 2 security fixes. The summary below is for SA-CONTRIB-2026-240, the most serious of them.
The fix adds the `_csrf_token: 'TRUE'` requirement to the paragraph delete, up, and down routes in `frontend_editing.routing.yml` to protect against Cross-Site Request Forgery.
Also in this release Added XSS protection to entity view alters and field edit access checks to paragraph helper methods.
1.9.2 to 1.9.3 1 commit, 3 files.
frontend_editing.module +9 −2frontend_editing.routing.yml +3 −0 fixsrc/ParagraphsHelper.php +20 −0
Full diff, 1.9.2 to 1.9.3
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
All 2 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.
Moderately critical · 1,622 sites report using it · SA-CONTRIB-2026-246 · on drupal.org
This module uses smart lossy compression techniques to reduce the file size of your PNG files.
The module does not sufficiently check access to image derivatives when those files are served via a file stream other than the private one. Anyone with no login could view private derived images. They could not alter any images or settings.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youDrupal must be configured to use a contributed file scheme to serve private derived images.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate TinyPNG to 2.0.2.
For developers: what the fix changed
The fix updates src/Controller/TinyPngImageStyleDownloadController.php around line 156 to always determine if a scheme is public by checking against a list of public schemes rather than relying on a token check.
2.0.1 to 2.0.2 1 commit, 1 file.
src/Controller/TinyPngImageStyleDownloadController.php +9 −9 fix
Full diff, 2.0.1 to 2.0.2
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 631 sites report using it · SA-CONTRIB-2026-239 · on drupal.org
This module lets non administrators approve or deactivate and delete users.
The module does not sufficiently check role delegation when approving users and offers an activate link for blocked administrators. An ordinary account on the site could view restricted user details and alter or add new user accounts.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAn attacker must have a role with one of the module's additional action access rights.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Simple User Management to 8.x-1.11.
For developers: what the fix changed
The fix introduces a RoleDelegationAccess service in src/RoleDelegationAccess.php to centralise role delegation checks and protect user 1. It updates simple_user_management_entity_operation_alter in simple_user_management.module and the user management forms to use this service, ensuring proper access checks for approving, deactivating, and deleting users.
Also in this release The release also adds extensive test coverage and a test module.
8.x-1.10 to 8.x-1.11 2 commits, 13 files including 5 tests.
simple_user_management.module +10 −16 fixsimple_user_management.permissions.yml +1 −1simple_user_management.services.yml +3 −0 fixsrc/Form/UserApprovalForm.php +36 −3 fixsrc/Form/UserChangePasswordForm.php +6 −8 fixsrc/Form/UserDeactivateForm.php +6 −15 fixsrc/Form/UserDeleteForm.php +9 −14 fixsrc/RoleDelegationAccess.php +63 −0 fix
Full diff, 8.x-1.10 to 8.x-1.11
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 335 sites report using it · SA-CONTRIB-2026-250 · on drupal.org
This module allows you to create custom fields with multiple values under the default table form.
The module does not properly escape filenames when rendering links to uploaded files. An administrator account could view hidden data through these links and alter or add new information to the site.
- Who could do thisOnly someone with an administrator login.
- Does it apply to youAn attacker must have a role with the access right to upload files into a Data Field file subfield.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Data field to 2.0.14.
For developers: what the fix changed
The fix updates FileUriFormatter.php to pass the filename as a placeholder to FormattableMarkup rather than concatenating it directly, ensuring it is properly escaped.
Also in this release Added a kernel test to verify filename escaping.
2.0.13 to 2.0.14 1 commit, 2 files including 1 test.
src/Plugin/DataField/FieldFormatter/FileUriFormatter.php +2 −1 fix
Full diff, 2.0.13 to 2.0.14
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 282 sites report using it · SA-CONTRIB-2026-234 · on drupal.org
This module provides a suite of Paragraphs bundles that works within the USWDS framework.
The module's templates do not sufficiently sanitise values passed to its markup. An ordinary account on the site could view restricted information and alter or add new data by injecting malicious scripts.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAn attacker must have a role to edit content that uses the paragraph bundles provided by the module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate USWDS Paragraph Components to 3.1.3.
For developers: what the fix changed
The fix removes the raw filter from column values and replaces field_text.value|raw with field_text.processed in multiple Twig templates to ensure proper sanitisation.
3.1.2 to 3.1.3 1 commit, 5 files.
modules/uswds_paragraph_components_cards/templates/paragraph--uswds-card-group-flag.html.twig +3 −3 fixmodules/uswds_paragraph_components_cards/templates/paragraph--uswds-card-group-regular.html.twig +3 −3 fixmodules/uswds_paragraph_components_cards/templates/regular-cards.html.twig +1 −1 fixmodules/uswds_paragraph_components_columns/templates/paragraph--uswds-2-columns.html.twig +1 −1 fixmodules/uswds_paragraph_components_columns/templates/paragraph--uswds-3-columns.html.twig +1 −1 fix
Full diff, 3.1.2 to 3.1.3
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 253 sites report using it · SA-CONTRIB-2026-249 · on drupal.org
This module enables you to restrict user logins on a multi domain site so that users can only log in on the domains assigned to them.
The module does not sufficiently enforce login restrictions when a user logs in by a method other than the standard login form. An ordinary account on the site could view restricted information and alter or add new data.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAn attacker must have a valid user account on the site, the enable restriction setting must be enabled on the Domain settings page, and the user must not have the access right to log in to any domain.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Domain Login Restrict to 8.x-1.5.
For developers: what the fix changed
The fix updates the domain_login_restrict_user_login function in domain_login_restrict.module to enforce login restrictions on all paths. It achieves this by checking the domain access of the user, invalidating the session, and throwing an access denied exception if the login is not permitted.
Also in this release The release also updates the README file with new PHP and Drupal version requirements and documentation on which logins are checked.
8.x-1.4 to 8.x-1.5 1 commit, 2 files.
README.md +18 −2domain_login_restrict.module +107 −80 fix
Full diff, 8.x-1.4 to 8.x-1.5
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 135 sites report using it · SA-CONTRIB-2026-226 · on drupal.org
This module enables you to upload CSV files to a field and display them as an interactive table.
The module does not sufficiently escape CSV cell and header values before passing them to the library. An ordinary account on the site could view restricted information and alter or add new data by injecting malicious scripts.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAn attacker must have a role with the access right to create or edit content that contains a CSV field.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate CSV Field to 3.0.7 or 2.0.10, whichever branch you are on.
For developers: what the fix changed
The fix introduces an `escapeCsvValue` function in `js/csv-field.js` that uses `Drupal.checkPlain()` to sanitise CSV cell and header values before they are passed to the DataTables library.
Also in this release The release also updates `fgetcsv` calls for PHP 8.4 compatibility, adds GitLab CI configuration, and updates tests.
3.0.6 to 3.0.7 1 commit, 8 files including 2 tests.
.cspell-project-words.txt +16 −0.gitlab-ci.yml +53 −0csv_field.libraries.yml +2 −0js/csv-field.js +57 −21 fixsrc/Plugin/Field/FieldFormatter/CsvFileTableFormatter.php +1 −1src/Plugin/Field/FieldWidget/CsvFileWidget.php +18 −16
Full diff, 3.0.6 to 3.0.7 · Full diff, 2.0.9 to 2.0.10
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 128 sites report using it · SA-CONTRIB-2026-251 · on drupal.org
This module extracts text from uploaded documents and exposes that extraction to AI agents and automators as a tool.
The module does not sufficiently check whether the current user is permitted to view a file before extracting its contents. An ordinary account on the site could view the contents of files they could not otherwise download, including files held in the private file system. They could not alter any files or settings.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAn attacker must have a role with the access right to invoke AI tools.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate AI File to Text to 1.0.1.
For developers: what the fix changed
The fix adds an access check in `src/Plugin/AiFunctionCall/FileToText.php` using a new `loadAccessibleFileByUri` method to ensure the current user has permission to view the requested file before extracting its text.
Also in this release The release also hardens XML loading against XXE and adds protection against ZIP decompression bombs.
1.0.0 to 1.0.1 4 commits, 9 files including 2 tests.
.cspell-project-words.txt +6 −0ai_file_to_text.services.yml +4 −0composer.json +1 −1src/Extractor/OdtExtractor.php +7 −2src/Extractor/PopplerPdfExtractor.php +3 −1src/Plugin/AiFunctionCall/FileToText.php +48 −1 fixsrc/Plugin/DocumentLoader/FileDocumentLoader.php +177 −2
Full diff, 1.0.0 to 1.0.1
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 86 sites report using it · SA-CONTRIB-2026-237 · on drupal.org
This module allows healthcare professionals to log in to a shared account on the Drupal website using their DocCheck credentials.
The module does not sufficiently verify the authentication data with the DocCheck interface in some cases. Anyone with no login could view restricted healthcare professional information. They could not alter any data.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate DocCheck Basic to the latest release.
For developers: what the fix changed
The code change for this release could not be fetched from git.drupalcode.org.
Moderately critical · Theme · no install count published · SA-CONTRIB-2026-231 · on drupal.org
This theme provides a front end design for transparency and open government sites, including a table preview of CSV files attached to content.
The theme does not sufficiently check file access when it renders a table preview of CSV files attached to content. Anyone with no login could view the contents of a file on the page even if their download of the file is refused. They could not alter any files.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youThe site must store the CSV files outside the public file system and must restrict their download beyond access to the content itself with an additional module or custom code.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Ágora Transparency Theme to 1.2.3.
For developers: what the fix changed
The fix adds an access check using hook_file_download in _agora_theme_csv_element() to ensure the user has permission to download the CSV file before rendering its preview, and prevents caching of the preview for private files using _agora_theme_csv_no_reuse().
Also in this release The release also includes several bug fixes and improvements, such as fixing focus rings, adjusting logo dimensions, adding a theme setting for the masthead opening line, and updating documentation.
1.2.1 to 1.2.3 21 commits, 27 files including 16 tests.
README.md +54 −21agora_theme.info.yml +1 −1agora_theme.theme +231 −3 fixcomposer.json +1 −1config/install/agora_theme.settings.yml +11 −0config/schema/agora_theme.schema.yml +11 −0css/components.css +0 −0css/typography.css +30 −0js/table-scroll.js +9 −0templates/block--system-branding-block.html.twig +16 −6theme-settings.php +29 −6
Full diff, 1.2.1 to 1.2.3
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · no install count published · SA-CONTRIB-2026-229 · on drupal.org
This module is part of a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.
A module specific to this distribution does not sufficiently sanitise media names. An ordinary account on the site could view restricted information and alter or add new data by injecting malicious scripts.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAn attacker must have a role with the ability to create or edit a media item.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Sector Distribution to 10.3.3 or 10.4.2, whichever branch you are on.
For developers: what the fix changed
The fix resolves the XSS vulnerability by using placeholders (`@name` and `:url`) in `TranslatableMarkup` instead of directly concatenating the media entity's name and URL into the markup in `sector_media_form_alter()`.
Also in this release The release also includes deprecation fixes, updates to composer dependencies, and replaces `check_markup` with `processed_text` render arrays in embedded content plugins.
10.3.2 to 10.3.3 1 commit, 9 files.
composer.json +3 −2modules/sector_media/sector_media.module +14 −8 fixmodules/sector_news/config/install/core.entity_view_mode.node.search_result.yml +10 −0modules/sector_news/config/optional/search_api.index.sector_news.yml +0 −0modules/sector_text_formats/modules/sector_embedded_content_examples/src/Plugin/EmbeddedContent/Disclosure.php +11 −3modules/sector_text_formats/modules/sector_embedded_content_examples/src/Plugin/EmbeddedContent/Note.php +12 −4modules/sector_users/sector_users.install +10 −5sector.install +1 −1src/SectorInstallHelpers.php +2 −1
Full diff, 10.3.2 to 10.3.3 · Full diff, 10.4.1 to 10.4.2
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
