Drupal Security

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:UncommonVulnerability: Cross-site scriptingAffected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108515Description: 

The Drupal core Link module provides a field type that can be used for internal and external URLs.

The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.10.
• If you use Drupal 11.3.x, update to Drupal 11.3.19.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

• If you use Drupal 10.6.x, update to Drupal 10.6.19.
• Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.

Reported By: 

• dev-winty

Fixed By: 

• Benji Fisher (benjifisher) of the Drupal Security Team
• catch (catch) of the Drupal Security Team
• David Cameron (dcam)
• Shawn Duncan (fathershawn)
• Lee Rowlands (larowlan) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Benji Fisher (benjifisher) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• James Gilliland (neclimdul) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Ra Mänd (ram4nd), provisional member of the Drupal Security
• Jess (xjm) of the Drupal Security Team

Project: Gin Admin ThemeProject machine name: ginDate: 2026-October-14Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: <4.1.4 || >=5.0.0 <5.0.16CVE IDs: CVE-2026-110738Description: 

Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators.

The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes or the administer menu permission.

Solution: 

Install the latest version:

• If you use version 4 of the Gin theme, upgrade to Gin 4.1.4.
• If you use version 5 of the Gin theme, upgrade to Gin 5.0.16.

Reported By: 

• Pablo López (plopesc)

Fixed By: 

• Jürgen Haas (jurgenhaas)

Coordinated By: 

• catch (catch) of the Drupal Security Team
• Damien McKenna of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Drupal coreProject machine name: drupalDate: 2026-October-14Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Remote code executionAffected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2CVE IDs: CVE-2026-108097Description: 

A remote code execution vulnerability exists within the Field UI module in Drupal core.

The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.

The vulnerability can be mitigated by uninstalling the core Field UI module (field_ui), which will provide protection while sites are updated.

Drupal Steward protection:

This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.10.
• If you use Drupal 11.3.x, update to Drupal 11.3.19.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

• If you use Drupal 10.6.x, update to Drupal 10.6.19.
• Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team
• Octavio Galland (ogalland-tob)

Fixed By: 

• catch (catch) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• catch (catch) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Tim Hestenes Lehnen (hestenet)
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Date: 2026-October-12Security risk: Critical 19 ∕ 25 AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:AllDescription: 

There will be a Drupal core security release for all supported branches on October 14, 2026 between 16:00 and 21:00 UTC. (To see this in your local timezone, refer to the Drupal Core Calendar.) Based on our analysis this vulnerability rates at 19/25 on our risk calculator.

The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days.

We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.

This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

Affected versions

All currently supported versions of Drupal core are affected, including:

• Drupal 11.4.x
• Drupal 11.3.x
• Drupal 10.6.x

Drupal 12.0.0-beta1 is also affected. New beta releases will be provided following the security updates for the supported branches.

All versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported. Sites on those versions should update as soon as possible to avoid this and other publicly disclosed vulnerabilities.

Disclosure policy

Neither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made. Security release announcements will appear on the Drupal.org security advisory page, which has RSS feeds. The announcement will also be made public on:

• The #security-team channel of the Drupal community Slack
• Bluesky
• Mastodon
• X (formerly Twitter)
• LinkedIn
• By email for those who have subscribed to our email list. (To subscribe to the email list: log in on Drupal.org, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab.)

Coordinated By: 

• Bram Driesen (bramdriesen) of the Drupal Security Team
• catch (catch) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Michael Hess (mlhess) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Advanced FilesystemProject machine name: advanced_filesystemDate: 2026-October-07Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-Site Request ForgeryAffected versions: <1.0.28CVE IDs: CVE-2026-107262Description: 

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem.

The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.

The vulnerability is mitigated by the fact that advanced_filesystem_backup module must be enabled.

Solution: 

Install the latest version:

• If you use the Advanced File System module, upgrade to Advanced File System 1.0.28

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Cristiano Demari (cristianodemari)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Restrict route by IPProject machine name: restrict_route_by_ipDate: 2026-October-07Security risk: Critical 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <1.3.1 || >=2.0.0 <2.0.1CVE IDs: CVE-2026-107255Description: 

This module enables you to restrict access to routes by IP address.

The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic.

Solution: 

Install the latest version:

• If you use the Restrict route by IP 2.0.x, upgrade to Restrict route by IP 2.0.1
• If you use the Restrict route by IP 1.3.x, upgrade to Restrict route by IP 1.3.1

Reported By: 

• Elia Wehbe (ewehbe)

Fixed By: 

• Elia Wehbe (ewehbe)
• solideogloria

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Examples for DevelopersProject machine name: examplesDate: 2026-October-07Security risk: Less critical 8 ∕ 25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Allocation of resources without limits or throttlingAffected versions: <4.0.7CVE IDs: CVE-2026-107312Description: 

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality.

The "Email Example" feature implemented by the email_example submodule can be used to send illegitimate emails to arbitrary email addresses.

Therefore, the email_example sub-module is being removed from Examples for Developers until a version demonstrating security best practices can be added back in the future. Developers who based a new module on this example should review their code.

Solution: 

Any site with the email_example submodule installed should uninstall it immediately. Then, install the latest version of Examples for Developers:

• If you are using Examples for Developers 4.0.x, upgrade to Examples for Developers 4.0.7.

Developers who based a new module or custom code on this example should review their code.

Reported By: 

• Alberto Paderno (avpaderno)

Fixed By: 

• Alberto Paderno (avpaderno)
• Marco Villegas (marvil07)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Permissions by TermProject machine name: permissions_by_termDate: 2026-October-07Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: <3.1.41CVE IDs: CVE-2026-107311Description: 

This module enables you to restrict view access to single nodes via taxonomy terms.

The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API.

This vulnerability is mitigated by the fact that it requires a specific module configuration, references to a deleted term, and access via JSON:API to be present.

Solution: 

Install the latest version:

• If you use the Permissions by Term module, upgrade to Permissions by Term 3.1.41

Reported By: 

• ayrmax

Fixed By: 

• Peter Majmesku (jepster_)
• Marc-Oliver Teschke (marcoliver)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: FreelinkingProject machine name: freelinkingDate: 2026-October-07Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information DisclosureAffected versions: <4.0.3CVE IDs: CVE-2026-107310Description: 

This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content.

The module doesn’t sufficiently prevent page titles being viewed for certain privately-accessible URLs.

This vulnerability is mitigated by the fact that an attacker must have access to use a text format with the Freelinking plugin configured to allow privately-accessible external URLs to be crawled. Site administrators may want to disable this functionality to evaluate any risk.

Solution: 

Install the latest version:

• If you use the Freelinking module, upgrade to Freelinking 4.0.3

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Marcus Johansson (marcus_johansson)
• Matthew Radcliffe (mradcliffe)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team

Project: Easy BreadcrumbProject machine name: easy_breadcrumbDate: 2026-October-07Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: <2.0.11CVE IDs: CVE-2026-107309Description: 

This module enables you to show a breadcrumb trail for taxonomy term hierarchies.

The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment.

This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" (term_hierarchy) must be enabled, and at least one term has a term in the parent hierarchy that is unpublished.

Solution: 

Install the latest version:

• If you use the Easy Breadcrumb module, upgrade to Easy Breadcrumb 2.0.11

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Brooke Mahoney (loopduplicate)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: CountryProject machine name: countryDate: 2026-October-07Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <2.1.3 || >=2.2.0 <2.2.1CVE IDs: CVE-2026-107308Description: 

The module Country provides a dedicated field type for Drupal core's official country list.

The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability.

This vulnerability is mitigated by the fact that it can not occur out of the box with the Country module, additional module(s) or custom code is required.

Solution: 

Install the latest version:

• If you use the Country module 2.2.x, upgrade to Country 2.2.1.
• If you use the Country module 2.1.x, upgrade to Country 2.1.3.

Reported By: 

• Conrad Lara (cmlara)

Fixed By: 

• Boris Doesborg (batigolix)
• Conrad Lara (cmlara)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Damien McKenna (damienmckenna) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: SmartLinker AIProject machine name: smartlinker_aiDate: 2026-October-07Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Information disclosureAffected versions: <1.0.3CVE IDs: CVE-2026-107307Description: 

This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to.

The module's search query did not respect entity access when returning results to the browser.

This vulnerability is mitigated by the fact that an user must have permission to use the AI CKEditor "Generate internal links" feature on a text format.

Solution: 

Install the latest version:

Upgrade to SmartLinker AI 1.0.3.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Marcus Johansson (marcus_johansson)
• Zeeshaan khann (zeeshan_khan)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Menu Link AttributesProject machine name: menu_link_attributesDate: 2026-October-07Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross-site scriptingAffected versions: <1.8.0CVE IDs: CVE-2026-107306Description: 

This module enables you to add HTML attributes to menu links and their container elements (<li>).

The module doesn't sufficiently sanitize the attributes it applies to menu link container elements.

This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "Administer menus and menu links" and "Use menu link attributes". In addition, an unsafe container attribute must already be configured by a user with the restricted permission "Administer menu link attributes". The default configuration is not affected.

Solution: 

Install the latest version:

• If you use the Menu Link Attributes module for Drupal 8.x or later, update to Menu Link Attributes 8.x-1.8.

After updating, run the database updates. The update removes any unsafe attribute definitions from the module's configuration and clears the render cache, so previously rendered menus no longer contain unsafe attributes.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Joshua Sedler (grevil)
• Marcus Johansson (marcus_johansson)
• Yannick (yannickoo)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: DKANProject machine name: dkanDate: 2026-October-07Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <4.0.4 || >=4.1.0 <4.1.5CVE IDs: CVE-2026-107267Description: 

The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables and exposes them for querying with a JSON API.

The module does not correctly check access for all of its endpoints, leading to a potential access bypass.

The vulnerability is mitigated by the fact that it is only impactful for sites that do not give "access content" permission to the anonymous role.

Solution: 

Install the latest version:

• If you use DKAN 4.1.x, upgrade to DKAN 4.1.5
• If you use DKAN 4.0.x, upgrade to DKAN 4.0.4

Reported By: 

• Rodel Duterte (rduterte)

Fixed By: 

• Dan Feder (dafeder)
• Rodel Duterte (rduterte)
• Steve Wirt (swirt)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Two Factor Authentication - TFA / Passwordless LoginProject machine name: miniorange_2faDate: 2026-October-07Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information disclosureAffected versions: <5.4.1 || >=5.5.0 <5.5.2CVE IDs: CVE-2026-107268Description: 

This module enables you to add an extra layer of verification for user login flow.

The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated users.

The vulnerability is mitigated by the fact that Headless 2FA must be turned on by a user with a miniorange 2fa headless permission, which is a restricted permission.

Solution: 

Install the latest version:

• If you use the 5.5.x branch, upgrade to Two Factor Authentication - TFA / Passwordless Login 5.5.2
• If you use the 5.4.x branch, upgrade to Two Factor Authentication - TFA / Passwordless Login 5.4.1

Reported By: 

• Nam Nguyen Le Thanh (yuwkaa)

Fixed By: 

• Mohammed Hisam (hisam45)
• Nam Nguyen Le Thanh (yuwkaa)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Xray AuditProject machine name: xray_auditDate: 2026-October-07Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <1.6.3 || >=2.0.0 <2.0.4 || >=3.0.0 <3.1.1CVE IDs: CVE-2026-96389Description: 

This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration.

The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or otherwise access-restricted content.

This vulnerability is mitigated by the fact that field-level access is still enforced, so fields that are themselves access-restricted (for example a user's email or password hash) are not disclosed.

Solution: 

Install the latest versions:

• If you use the X-ray Audit version 3.1.x, upgrade to X-ray Audit 3.1.1.
• If you use the X-ray Audit version 2.0.x, upgrade to X-ray Audit 2.0.4.
• If you use the X-ray Audit version 1.6.x, upgrade to X-ray Audit 1.6.3.

Reported By: 

• eduardo morales alberti
• Hemant Gupta (guptahemant)
• Marcus Johansson (marcus_johansson)
• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Luis Ruiz Peidró (lpeidro)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Views ShareProject machine name: views_shareDate: 2026-October-07Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.0.1CVE IDs: CVE-2026-107266Description: 

This module enables you to "share" a view display within another website via an iframe.

The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance.

This vulnerability is mitigated by the fact that an attacker must know the view and display IDs.

Solution: 

Install the latest version:

• If you use the Views Share module, upgrade to Views Share 2.0.1

Reported By: 

• Hemant Gupta (guptahemant)

Fixed By: 

• Daniel Cothran (andileco)
• Hemant Gupta (guptahemant)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: LeafletProject machine name: leafletDate: 2026-October-07Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingAffected versions: <10.4.13CVE IDs: CVE-2026-107265Description: 

The Leaflet module provides integration with the Leaflet JS mapping library.

Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability.

This vulnerability is mitigated by the fact an attacker needs to have permission to create or edit content that is used in a Leaflet map.

Solution: 

Install the latest version:

• If you use the Leaflet module, upgrade to release 10.4.13

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Italo Mairo (itamair)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Inline Formatter FieldProject machine name: inline_formatter_fieldDate: 2026-October-07Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Server-side template injectionAffected versions: <4.2.0CVE IDs: CVE-2026-107264Description: 

The Inline Formatter Field module allows site builders to template and style entities with a field.

This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands.

Solution: 

Install the latest version:

• If you use the Inline Formatter Field module, upgrade to Inline Formatter Field 4.2.0

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Bobby Saul (bobbysaul)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: GutenbergProject machine name: gutenbergDate: 2026-October-07Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassAffected versions: <2.15.0 || >=3.0.0 <3.0.7CVE IDs: CVE-2026-107263Description: 

This module provides a new UI experience for node editing using the Gutenberg Editor library.

The module does not sufficiently check entity access in several editor endpoints.

This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission.

Solution: 

Install the latest version:

• If you use the Gutenberg module versions 3.0.x, upgrade to Gutenberg 3.0.7
• If you use the Gutenberg module versions 8.x-2.x, upgrade to Gutenberg 8.x-2.15

Reported By: 

• Tommaso Gregori (p1s1o)
• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Stephan Zeidler (szeidler)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team