Drupal Security

Project: BootstrapProject machine name: bootstrapDate: 2026-October-21Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: <3.45.0CVE IDs: CVE-2026-114538Description: 

Provides the Bootstrap front-end framework as a Drupal theme.

Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site scripting vulnerability.

This vulnerability is mitigated by only affecting the optional tooltip and popover features. A short-term mitigation is to disable tooltips and popovers on admin/appearance/settings/bootstrap or admin/appearance/settings/my_bootstrap_subtheme.

Solution: 

Install the latest version:

• If you use Bootstrap 8.x-3.x, upgrade to Bootstrap 8.x-3.45

The 5.0.x branch of Bootstrap is not affected.

Reported By: 

• Ra Mänd (ram4nd), provisional member of the Drupal Security Team

Fixed By: 

• Joseph Olstad (joseph.olstad)
• Ra Mänd (ram4nd), provisional member of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Ra Mänd (ram4nd), provisional member of the Drupal Security Team

Project: View UnpublishedProject machine name: view_unpublishedDate: 2026-October-21Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.5.0CVE IDs: CVE-2026-114537Description: 

This module allows granting access to unpublished nodes per content type.

For nodes with at least one unpublished translation, the module grants every user with the "access content" permission view access to the published translations of that node. This overrides the restrictions of other node access modules, such as Content Access or Domain Access, that might have been in place for these translations.

This vulnerability is mitigated by the fact that the site must be multilingual, a node must have both unpublished and published translations, and another node access module must restrict view access to the published translations.

Solution: 

Install the latest version:

• If you use the View Unpublished, upgrade to View Unpublished 8.x-1.5

Reported By: 

• Andrew L (andrew_l)
• Tobias Bähr (tobiasb)

Fixed By: 

• Oleksandr Kuzava (nginex)
• Gonçalo Mateus (lolgm)
• Tobias Bähr (tobiasb)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: USWDS Paragraph ComponentsProject machine name: uswds_paragraph_componentsDate: 2026-October-21Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingAffected versions: <3.1.3CVE IDs: CVE-2026-114536Description: 

This module provides a suite of Paragraphs bundles that works within the USWDS framework.

The module's twig templates do not sufficiently sanitize values passed to its markup.

This vulnerability is mitigated by the fact that an attacker must have a role to edit content that uses the paragraph bundles provided by the module.

Solution: 

Install the latest version:

• If you use the USWDS Paragraph Components, upgrade to USWDS Paragraph Components 3.1.3

Reported By: 

• Hemant Gupta (guptahemant)
• Lee Rowlands (larowlan) of the Drupal Security Team

Fixed By: 

• Stephen Mustgrave (smustgrave)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Swiper formatterProject machine name: swiper_formatterDate: 2026-October-21Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Information disclosureAffected versions: <2.1.2 || >=3.0.1 <3.1.0CVE IDs: CVE-2026-114535Description: 

Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events.

This module provides a route for displaying published content entities in a dialog. The route does not sufficiently verify the current user's access to the specific entity.

This vulnerability is mitigated by the fact that only rendered output is returned, and field-level access controls are still enforced.

Solution: 

Install the latest version:

• If you use the Swiper formatter module 3.x, upgrade to Swiper formatter 3.1.0
• If you use the Swiper formatter module 2.x, upgrade to Swiper formatter 2.1.2

Reported By: 

• Ryan Solomon (phizes)
• Julian Pustkuchen (anybody)
• Joshua Sedler (grevil)

Fixed By: 

• Drupal Lady (bbu23)
• Joshua Sedler (grevil)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Block AttributesProject machine name: block_attributesDate: 2026-October-21Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site ScriptingAffected versions: <2.1.0CVE IDs: CVE-2026-114534Description: 

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format.

The module does not sufficiently sanitize attributes against cross site scripting.

This issue is mitigated by the fact that the attacker must have the administer blocks permission.

Solution: 

Install the latest version:

• If you use the Block Attributes module, upgrade to Block Attributes 2.1.0

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• David Suissa (dydave)
• Kostia Bohach (_shy)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Ágora Transparency ThemeProject machine name: agora_themeDate: 2026-October-21Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: <1.2.3CVE IDs: CVE-2026-114533Description: 

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content.

The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whose download of the file is refused, can still read the file's contents on the page. A preview rendered for one visitor can also be cached and shown to another.

This vulnerability is mitigated by the fact that the site must store the CSV files outside the public file system, and must restrict their download beyond access to the content itself with an additional module or custom code. Files in the public file system are not affected.

Solution: 

Install the latest version:

If you use the Ágora Transparency Theme for Drupal 11, upgrade to Ágora Transparency Theme 1.2.3.

Reported By: 

• Andrés Moreno Rubio (andresmoreno28)

Fixed By: 

• Andrés Moreno Rubio (andresmoreno28)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: UI IconsProject machine name: ui_iconsDate: 2026-October-21Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: <1.1.3 || >=2.0.0 <2.0.2CVE IDs: CVE-2026-114532Description: 

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text.

Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have access to edit content with a text format that allows the UI Icons CKEditor 5 button.

Solution: 

Install the latest version:

• If you use the UI Icons 2.0.x module, upgrade to UI Icons 2.0.2
• If you use the UI Icons 1.1.x module, upgrade to UI Icons 1.1.3

UI Icons 1.0.x is not supported. Sites using it should upgrade to UI Icons 1.1.3 or 2.0.2.

Reported By: 

• Jean Valverde (mogtofu33)

Fixed By: 

• Jean Valverde (mogtofu33)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team

Project: Sector DistributionProject machine name: sectorDate: 2026-October-21Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <10.3.3 || >=10.4.0 <10.4.2CVE IDs: CVE-2026-107260Description: 

Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.

A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit.

This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.

Solution: 

Install the latest version:

• If you use the 10.3.x Sector distribution, upgrade to Sector 10.3.3
• If you use the 10.4.x Sector distribution, upgrade to Sector 10.4.2

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Drew Webber (mcdruid) of the Drupal Security Team
• Soames (somatick)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team

Project: Swiper formatterProject machine name: swiper_formatterDate: 2026-October-21Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <2.1.2 || >=3.0.1 <3.1.0CVE IDs: CVE-2026-114531Description: 

The module provides integration with third party JS library SwiperJs.

User-entered text is used as part of the slide without appropriate filtering leading to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker would need a role with permission to edit the caption.

Solution: 

Install the latest version:

• If you use the Swiper formatter module 3.x, upgrade to Swiper formatter 3.1.0
• If you use the Swiper formatter module 2.x, upgrade to Swiper formatter 2.1.2

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team
• Julian Pustkuchen (anybody)
• Joshua Sedler (grevil)

Fixed By: 

• Drupal Lady (bbu23)
• Joshua Sedler (grevil)
• Drew Webber (mcdruid) of the Drupal Security Team
• nk_

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: DopupProject machine name: dopupDate: 2026-October-21Security risk: Critical 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Information disclosureAffected versions: <1.0.7CVE IDs: CVE-2026-114530Description: 

The Dopup module provides functionality for selecting and working with Webforms.

The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms.

Solution: 

Install the latest version:

• If you use the dopup module, upgrade to Dopup 1.0.7

Reported By: 

• Marcus Johansson (marcus_johansson)
• Rodel Duterte (rduterte)

Fixed By: 

• Rodel Duterte (rduterte)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: CSV FieldProject machine name: csv_fieldDate: 2026-October-21Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site ScriptingAffected versions: <2.0.10 || >=3.0.0 <3.0.7CVE IDs: CVE-2026-114529Description: 

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table.

The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content that contains a CSV field.

Solution: 

Install the latest version:

• If you use the CSV Field 3.0.x, upgrade to CSV Field 3.0.7
• If you use the CSV Field 2.0.x, upgrade to CSV Field 2.0.10

CSV Field 1.0.x is no longer supported and does not receive security coverage. Sites still on 1.0.x should upgrade to a supported branch.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Dima Storozhuk (dstorozhuk)
• Thomas Fleming (thomas.fleming)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Custom FormattersProject machine name: custom_formattersDate: 2026-October-21Security risk: Critical 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: Remote code executionAffected versions: <4.2.1CVE IDs: CVE-2026-114524Description: 

The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module.

The PHP formatter engine runs eval() to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about this behavior.

Solution: 

Install the latest version:

• If you use Custom Formatters, upgrade to Custom Formatters 4.2.1

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Stuart Clark (deciphered)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: ABCProject machine name: abcDate: 2026-October-21Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <1.25.0 || >=2.0.0 <2.0.1CVE IDs: CVE-2026-114525Description: 

The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus.

The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes.

This vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles, either through menu administration or through content menu settings where permitted.

Solution: 

Install the latest version:

• If you use ABC 8.x-1.x, upgrade to ABC 8.x-1.25.
• If you use ABC 2.0.x, upgrade to ABC 2.0.1.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Florian Radut (florian)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Black HoleProject machine name: black_holeDate: 2026-October-21Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <1.26.0 || >=2.0.0 <2.0.1CVE IDs: CVE-2026-114526Description: 

The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus.

The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes.

This vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles, either through menu administration or through content menu settings where permitted.

Solution: 

Install the latest version:

• If you use Black Hole 8.x-1.x, upgrade to Black Hole 8.x-1.26.
• If you use Black Hole 2.0.x, upgrade to Black Hole 2.0.1.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Florian Radut (florian)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Zero PointProject machine name: zeropointDate: 2026-October-21Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <1.30.0 || >=2.0.0 <2.0.1CVE IDs: CVE-2026-114528Description: 

The ZeroPoint theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus.

The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes.

This vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles, either through menu administration or through content menu settings where permitted.

Solution: 

Install the latest version:

• If you use Zero Point 8.x-1.x, upgrade to Zero Point 8.x-1.30.
• If you use Zero Point 2.0.x, upgrade to Zero Point 2.0.1.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Florian Radut (florian)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: UI IconsProject machine name: ui_iconsDate: 2026-October-21Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingAffected versions: <1.1.3 || >=2.0.0 <2.0.2CVE IDs: CVE-2026-114527Description: 

This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations.

The module doesn't sufficiently validate icon settings provided by users before they are rendered.

Solution: 

Install the latest version:

• If you use the UI Icons 2.0.x module, upgrade to UI Icons 2.0.2
• If you use the UI Icons 1.1.x module, upgrade to UI Icons 1.1.3

UI Icons 1.0.x is not supported. Sites using it should upgrade to UI Icons 1.1.3 or 2.0.2.

Reported By: 

• André Angelantoni (aangel)
• Octavio Galland (ogalland-tob)

Fixed By: 

• Jean Valverde (mogtofu33)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Ffmpeg Image ToolkitProject machine name: ffmpeg_image_toolkitDate: 2026-October-21Security risk: Highly critical 20 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:AllVulnerability: Remote Code ExecutionAffected versions: <1.0.3CVE IDs: CVE-2026-114523Description: 

This module enables you to use ffmpeg for image conversion

The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool.

This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site.

Solution: 

Install the latest version:

• If you use the Ffmpeg Image Toolkit 1.x, upgrade to Ffmpeg Image Toolkit 1.0.3

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Marcin Grabias (graber)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Date: 2026-October-21Description: 

PHP has announced a critical PHP security release for Wednesday, October 21, 2026, at 14:00 UTC. Reserve time to update PHP as soon as the release is available. If you manage PHP yourself, you’ll need to apply the update. If your host manages it, follow their communications for timing and any required action.

Updating to a PHP release containing the patch to these vulnerabilities is the only complete mitigation.

Site owners are responsible for maintaining the security of their hosting platform

It is the policy of the Drupal Security Team that site owners are responsible for monitoring and maintaining the security of third-party libraries and any non-Drupal components of the application and hosting platform. In rare cases, the Drupal Security Team will post an informational public service announcement (PSA) such as this one, but the remit of the Drupal Security Team remains limited to code hosted on Drupal.org’s systems. Previous PSAs on third-party code in the Drupal ecosystem include:

• External libraries and plugins - PSA-2011-002
• Various Third-Party Vulnerabilities - PSA-2019-09-04
• Third-Party Libraries and Supply Chains - PSA-2024-06-26
• Third-Party Libraries and Supply Chains - PSA-2025-09-17

This post is likely to be updated as the situation evolves and more information is available.

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• James Gilliland (neclimdul) of the Drupal Security Team
• Angie Byron (webchick) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Entity ListProject machine name: entity_listDate: 2026-October-14Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Remote code executionAffected versions: <3.0.10CVE IDs: CVE-2026-108099Description: 

The Entity List module provides a way to create lists of entities without Views.

The module has a remote code execution vulnerability.

The vulnerability is not directly exploitable with the module alone, but multiple serious exploit paths exist with other contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.

Solution: 

Install the latest version:

• Upgrade to Entity List 3.0.10.

Reported By: 

• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Octavio Galland (ogalland-tob)

Fixed By: 

• catch (catch) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Marc-Antoine MARTY (martygraphie)
• Drew Webber (mcdruid) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• catch (catch) of the Drupal Security Team
• Damien McKenna of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Tim Hestenes Lehnen (hestenet)
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108514Description: 

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.10.
• If you use Drupal 11.3.x, update to Drupal 11.3.19.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

• If you use Drupal 10.6.x, update to Drupal 10.6.19.
• Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.

Reported By: 

• Eric Tee (erictee2802)
• haii haii (hai27ii2o)
• C Huaruu (huarui)

Fixed By: 

• Benji Fisher (benjifisher) of the Drupal Security Team
• Jürgen Haas (jurgenhaas)
• Lee Rowlands (larowlan) of the Drupal Security Team
• Mingsong (mingsong), provisional member of the Drupal Security
• Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
• James Gilliland (neclimdul) of the Drupal Security Team
• Pablo López (plopesc)
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Coordinated By: 

• cilefen (cilefen) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• James Gilliland (neclimdul) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team