Security advisories
-
Drupal core: Third-party libraries
Project:Project machine name:drupalDate:2026-September-16Vulnerability:Third-party librariesAffected versions:>=10.5.0 <10.6.17 || >=11.0.0 <11.3.17 || >=11.4.0 <11.4.7Description:The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.
Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit this Cross-Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.
For more information, see CKEditor's security advisory:
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.7.
- If you use Drupal 11.3.x, update to Drupal 11.3.17.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.17.
- Drupal 10.5.x and below are end-of-life and do not receive security coverage.
Note that Drupal 8 and Drupal 9 have both reached end-of-life.
Instructions for contributed modulesSite owners should also review their site following the protocol for managing external libraries and plugins, as contributed projects may use additional CKEditor plugins not packaged in Drupal core.
CKEditor has also released another CVE in today's release that does not affect Drupal, but may affect custom plugins or other usecases:
Reported By:Fixed By:- catch (catch) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Coordinated By:- Bram Driesen (bramdriesen) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Moderately criticalDrupal core security advisories -
Security advisory coverage removed
Date:2026-July-22Description:QA Accounts enables you to login to a Drupal site using a well known username/password combination. When 1.0 was released, it also was marked for security coverage. The module prioritizes ease of use rather than security and is only intended to be used on sites that are not accessible on the internet (e.g. behind firewall or other protection). The maintainers are choosing to remove security coverage.
Solution:Ensure qa_accounts is not enabled on any publicly available site.
Reported By:Fixed By:QA AccountsDrupal public service announcements -
Drupal core: Cross-site scripting
Project:Project machine name:drupalDate:2026-July-15Vulnerability:Cross-site scriptingAffected versions:<10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*CVE IDs:CVE-2026-55805Description:The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability.
This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.4.
- If you use Drupal 11.3.x, update to Drupal 11.3.14.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.13.
- Drupal 10.5.x and below are end-of-life and do not receive security coverage.
Reported By:Fixed By:- danielveza
- Lee Rowlands (larowlan) of the Drupal Security Team
- Mingsong (mingsong) provisional member of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
Coordinated By:- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Moderately criticalDrupal core security advisories -
Drupal core: Cross-site scripting
Project:Project machine name:drupalDate:2026-July-15Vulnerability:Cross-site scriptingAffected versions:>=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.2.*CVE IDs:CVE-2026-15917Description:Drupal core 11.2 and above integrate the HTMX JavaScript library.
Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.4.
- If you use Drupal 11.3.x, update to Drupal 11.3.14.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- Drupal 10 core is not affected. However, certain contributed modules may be affected, so a Drupal 10.6 fix is included as hardening.
Reported By:- Pierre Rudloff (prudloff) of the Drupal Security Team
Fixed By:- Shawn Duncan (fathershawn)
- Pierre Rudloff (prudloff) of the Drupal Security Team
Coordinated By:- catch (catch) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Moderately criticalDrupal core security advisories -
Drupal core: Information disclosure
Project:Project machine name:drupalDate:2026-July-15Security risk:Vulnerability:Information disclosureAffected versions:<10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*CVE IDs:CVE-2026-15916Description:The Image module allows you to define and configure image fields.
The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than
private://.This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.
Information disclosure issues like this one are not generally given security advisories (as described in PSA-2023-07-12)). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.4.
- If you use Drupal 11.3.x, update to Drupal 11.3.14.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.13.
- Drupal 10.5.x and below are end-of-life and do not receive security coverage.
Reported By:Fixed By:- Benji Fisher (benjifisher) of the Drupal Security Team
- Kim Pepper (kim.pepper)
- Mohit Aghera (mohit_aghera)
Coordinated By:- Benji Fisher (benjifisher) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Moderately criticalDrupal core security advisories