Drupal Security

Project: htmLawedProject machine name: htmlawedDate: 2026-November-04Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: >=4.1.0 <4.1.11CVE IDs: CVE-2026-122079Description: 

The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.

The htmLawed filter does not sufficiently filter attributes, leading to a cross-site scripting (XSS) vulnerability.

This vulnerability affects sites on Drupal core > 11.2 or any version of core with the HTMX library.

Solution: 

Install the latest version:

• If you use version 4.1.x, upgrade to 4.1.11.
• 8.x-3.x versions are not affected.

Review configuration and update:

• For Text Formats that use the htmLawed filter, check that the filter's Config. setting includes data-hx-* for the deny_attribute parameter. E.g.: 'safe'=>1, 'elements'=>'a, em, strong, cite, code, ol, ul, li, dl, dt, dd', 'deny_attribute'=>'data-hx-*, id, style'

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• alpha2zee

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: htmLawedProject machine name: htmlawedDate: 2026-November-04Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >=3.0.0 <3.9.0 || >=4.0.0 <4.1.8CVE IDs: CVE-2026-122080Description: 

The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input.

The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting (XSS) vulnerability.

Only sites using an SQLite database are affected with versions of the htmLawed library prior to 1.2.17.

Solution: 

Install the latest version:

• If you use version 4.1.x, upgrade to 4.1.11 (was fixed in 4.1.8).
• If you use version 8.x-3.x, upgrade to 8.x-3.10 (was fixed in 8.x-3.9).

Alternately, replace the htmLawed.php and htmLawed_README.htm files in the module directory with new downloads for htmLawed library version >= 1.2.17.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• alpha2zee
• Pierre Rudloff (prudloff) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Islandora Project machine name: islandoraDate: 2026-November-04Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypass leading to arbitrary file overwriteAffected versions: <2.19.1CVE IDs: CVE-2026-122081Description: 

Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files.

The Islandora Text Extraction submodule also bypasses shared destination URI and file extension validation when attaching OCR output.

This vulnerability is mitigated by the fact that an attacker must have permission to update media or to update a node and create media.

Solution: 

Install the latest version:

• Upgrade to Islandora 2.19.1.

Reported By: 

• Whippet (VenusTech ADLab) (whippet)

Fixed By: 

• Annie Oelschlager (annieoelschlager)
• Joe Corall (joecorall)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Mime MailProject machine name: mimemailDate: 2026-November-04Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: <2.0.4CVE IDs: CVE-2026-122082Description: 

The Mime Mail module gives Drupal sites the ability to send HTML email messages.

Under rare site configuration conditions, a user with the ability to send HTML emails could send non-public data that had been uploaded to the files directory,

This vulnerability is mitigated by the fact the attacker would need advance knowledge of uploaded files, and to send HTML emails and set the recipient list.

Solution: 

Install the latest version:

• Upgrade to Mime Mail 2.0.4.

Reported By: 

• Rodel Duterte (rduterte)

Fixed By: 

• Mark Fullmer (mark_fullmer)
• Rodel Duterte (rduterte)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: AdobeAnalyticsProject machine name: adobe_analyticsDate: 2026-November-04Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: <1.1.0CVE IDs: CVE-2026-122083Description: 

This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site.

The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have permission to add or edit content that is configured to use the module's functionality.

Solution: 

Install the latest version:

• Upgrade to adobe_analytics 8.x-1.1.

Reported By: 

• Francisco Javier Rodriguez (nodles)

Fixed By: 

• Zeeshaan khann (zeeshan_khan)
• Joseph Olstad (joseph.olstad)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: WordsOnline ConnectorProject machine name: wordsonline_connectorDate: 2026-November-04Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:All/II:None/E:Theoretical/TD:AllVulnerability: SQL injectionAffected versions: >=2.0.0 <2.0.6CVE IDs: CVE-2026-122084Description: 

The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module.

The module doesn't properly validate data, resulting in an SQL Injection vulnerability. An attacker can use this to read data from the Drupal database, including user account data.

The vulnerability is mitigated by the fact that an attacker must be logged in and hold the Create translation jobs permission provided by TMGMT.

Solution: 

Install the latest version:

• Upgrade to WordsOnline Connector 2.0.6.
• 1.0.x is not affected.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Rey Kong (reykong)
• Luan Xuan Nguyen (luannguyen)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Extended HTML FilterProject machine name: extended_html_filterDate: 2026-November-04Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <1.0.4CVE IDs: CVE-2026-122078Description: 

The Extended HTML Filter module allows using style attributes in CKEditor.

The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.

Solution: 

Install the latest version:

• Upgrade to Extended HTML Filter 1.0.4.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Saif Bataineh (syfjo)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Allowed LanguagesProject machine name: allowed_languagesDate: 2026-November-04Security risk: Less critical 7 ∕ 25 AC:Complex/A:User/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.0.3CVE IDs: CVE-2026-122077Description: 

The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language.

The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create content in at least one language.

Solution: 

Install the latest version:

• Upgrade to Allowed Languages 2.0.3.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Lucas Hedding (heddn)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Password Separate FormProject machine name: change_pwd_pageDate: 2026-November-04Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.0.3CVE IDs: CVE-2026-122076Description: 

This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one.

The module doesn't sufficiently verify the current password in some cases.

This vulnerability is mitigated by the fact that an attacker must already have access to the victim's authenticated session (for example an unattended browser or a stolen session cookie). It allows that temporary session access to be turned into a persistent account takeover.

Solution: 

Install the latest version:

• If you use version 2.0.x, upgrade to Password Separate Form 2.0.3.

Reported By: 

• Motoki Kobayashi (otofu)

Fixed By: 

• Steven Ayers (bluegeek9)
• Motoki Kobayashi (otofu)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: SchedulerProject machine name: schedulerDate: 2026-November-04Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <1.7.0 || >=2.2.0 <2.2.3 || 2.0.* || 2.1.*CVE IDs: CVE-2026-122075Description: 

This module enables you to schedule content to be published or unpublished at a certain time in the future.

The module doesn't sufficiently check if a user has permission to change publication or unpublication dates. This might cause certain information to be publicly disclosed ahead of the scheduled time, or content to become inaccessible earlier or later than planned.

This vulnerability is mitigated by the fact that an attacker must already have permission to edit the affected content, and the content must be editable through a web services API like JSON:API or REST.

Solution: 

Install the latest version:

• If you use version 8.x-1.x, upgrade to Scheduler 8.x-1.7.
• If you use version 2.2.x, upgrade to Scheduler 2.2.3.
• If you use version 2.3.x, upgrade to Scheduler 2.3.1.
• Version 2.1.x branch is no longer supported. Sites on this version should update to 2.2.3 or 2.3.1.

Reported By: 

• Marcus Johansson (marcus_johansson)
• Rodrigo Cabo (rodrigo-cabo)

Fixed By: 

• Jonathan Smith (jonathan1055)
• Marcus Johansson (marcus_johansson)
• Pieter Frenssen (pfrenssen)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Reset Password Email/SMS OTPProject machine name: reset_password_email_otpDate: 2026-November-04Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.0.5CVE IDs: CVE-2026-122074Description: 

This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links.

The module doesn't sufficiently validate resetting passwords for blocked users.

This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the affected user for the attacker to use the new password.

Solution: 

Install the latest version:

• Upgrade to Reset Password Email/SMS OTP 1.0.5.

Reported By: 

• Scott Euser (scott_euser)

Fixed By: 

• Andrii Sakhaniuk (nnevill)
• Scott Euser (scott_euser)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Name FieldProject machine name: nameDate: 2026-November-04Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <1.6.0CVE IDs: CVE-2026-122073Description: 

The Name Field module provides a field for storing a personal name as separate components.

The module does not sufficiently sanitize values under some circumstances. A name stored on the field can be interpreted as HTML, which can lead to a cross-site scripting (XSS) vulnerability.

Solution: 

Install the latest version:

• Upgrade to Name Field 8.x-1.6.

Reported By: 

• Conrad Lara (cmlara)

Fixed By: 

• Steven Ayers (bluegeek9)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Forum AccessProject machine name: forum_accessDate: 2026-November-04Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <2.0.3CVE IDs: CVE-2026-122072Description: 

This module allows forums to be set private and to be given moderators.

The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access.

This vulnerability is mitigated by the fact that the vulnerability only exists where the forum field for the forum topic is not using the default select widget, or when content is created through a web services API.

Solution: 

Install the latest version:

• Upgrade to Forum Access 2.0.3.

Reported By: 

• nico.b

Fixed By: 

• Mikhail Khasaya (dillix)
• Kurucz István (nevergone)
• nico.b
• Hans Salvisberg (salvis)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce EscrowProject machine name: commerce_escrowDate: 2026-November-04Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.1.0CVE IDs: CVE-2026-122071Description: 

This module enables you to accept payments through Escrow.com with Drupal Commerce.

The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress.

Solution: 

Install the latest version:

• Upgrade to Commerce Escrow 1.1.0. (1.0.x versions are no longer supported.)

After updating, register the new webhook URL with Escrow.com. It is shown on the configuration form of each Escrow payment gateway.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Valentino Međimorec (valic)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce Product AlternativeProject machine name: commerce_product_alternativeDate: 2026-November-04Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.0.1CVE IDs: CVE-2026-122070Description: 

This module lets customers replace an item in their cart with one of the alternative product variations listed for it.

The module does not check that a cart belongs to the current visitor when the visitor is not logged in. An anonymous visitor can view items in other anonymous visitors' carts, including product names and prices, and replace those items with one of their listed alternatives.

The vulnerability is mitigated by the fact that only carts of anonymous visitors are affected; carts of authenticated customers are not.

Solution: 

Install the latest version:

• Upgrade to Commerce Product Alternative 1.0.1.

Reported By: 

• Tim de Jong (tim_dj)

Fixed By: 

• Jakub Piasecki (zaporylie)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: AlternativeCommerce PayPal CheckoutProject machine name: basket_paypalDate: 2026-November-04Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.1.1 || >=2.0.0 <2.0.0-beta2CVE IDs: CVE-2026-122069Description: 

The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal.

The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causing the associated order to be marked as paid without completing a payment.

Solution: 

Install the latest version:

• Upgrade to AlternativeCommerce PayPal 1.1.1.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Helena Zajika (helena zajika)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Highlight Js syntax highlighterProject machine name: highlight_jsDate: 2026-November-04Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <1.3.1CVE IDs: CVE-2026-122068Description: 

This module enables you to add syntax-highlighted code snippets to content using CKEditor 5.

The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting (XSS) vulnerability.

Solution: 

Install the latest version:

• Upgrade to highlight_js 1.3.1.

Reported By: 

• André Angelantoni (aangel)
• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Norman Kämper-Leymann (norman.lol)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: REST & JSON API Authentication for DrupalProject machine name: rest_api_authenticationDate: 2026-November-04Security risk: Critical 17 ∕ 25 AC:Basic/A:None/CI:Some/II:All/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <3.2.1CVE IDs: CVE-2026-122067Description: 

The REST & JSON API Authentication module provides API authentication for Drupal sites.

The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated.

Solution: 

Install the latest version:

• Upgrade to REST & JSON API Authentication 3.2.1.

If you can't immediately upgrade, ensure that you have an API key generated, and audit for suspicious access by administrative users in the logs.

Reported By: 

• Sanjeev Kumar (ksanjeev284)

Fixed By: 

• Mohammed Hisam (hisam45)
• purva_shende

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Workflow NotificationsProject machine name: workflow_notificationsDate: 2026-November-04Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <3.0.3CVE IDs: CVE-2026-122066Description: 

This module enables you to send messages ("Notifications") to users upon a certain Workflow state change.

The module doesn't sufficiently protect the Notification settings page where an attacker can make unauthorized changes.

Solution: 

Install the latest version:

• Upgrade to workflow_notifications 3.0.3.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• John Voskuilen (johnv)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Simple OAuth (OAuth2) & OpenID ConnectProject machine name: simple_oauthDate: 2026-November-04Security risk: Critical 15 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <5.2.6 || >=6.0.0 <6.0.10 || >=6.1.0 <6.1.4CVE IDs: CVE-2026-122058Description: 

This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them.

The module doesn't sufficiently restrict access to consumer configuration. Users who can create or edit consumers can potentially configure malicious consumers and obtain tokens with additional privileges. This can allow them to access the site as another user, up to full administrative access.

This vulnerability is mitigated by the fact that an attacker must have a role with the Add consumer entities or Update own consumer entities permissions.

Solution: 

Install the latest version:

• If you use version 6.1.x, upgrade to Simple OAuth (OAuth2) & OpenID Connect 6.1.4.
• If you use version 6.0.x, upgrade to Simple OAuth (OAuth2) & OpenID Connect 6.0.10.
• If you use version 5.2.x, upgrade to Simple OAuth (OAuth2) & OpenID Connect 5.2.6.

Additional steps are required after updating:

• Configuring the access a consumer grants requires the new Administer consumer access settings permission. Grant it only to trusted roles.
• In 6.1.x, Client Credentials tokens are now always limited to their scopes. The update does not change existing consumers. Review them, and revoke their tokens if in doubt.

Reported By: 

• Andrei Lungu (andrei.lungu)
• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Bojan Bogdanovic (bojan_dev)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team