Hírolvasó
Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111
This module allows you to specify an HTTP header name to determine the client's IP address.
The module doesn't sufficiently handle all cases under the scenario if Drupal Core settings $settings['reverse_proxy'] is set to TRUE and $settings['reverse_proxy_addresses'] is configured.
This vulnerability allows an attacker to spoof a request IP address (as Drupal sees it), potentially bypassing a variety of controls.
Solution:To resolve this issue, sites must both upgrade and confirm their settings.
Install the latest 1.1.2 version.
Check your settings:
- $settings['reverse_proxy'] (Drupal Core setting);
- $settings['reverse_proxy_addresses'] (Drupal Core setting);
- $settings['reverse_proxy_header'] (this module setting);
- $settings['reverse_proxy_header_trusted_addresses_ignore'] (this module setting introduced in this release).
This security release does not affect your Drupal instance if:
- or $settings['reverse_proxy'] is not set or set to FALSE;
- or $settings['reverse_proxy_header'] is not set or set to FALSE;
- or $settings['reverse_proxy_addresses'] is not set or set to an empty array.
This security release may affect your Drupal instance if:
- and $settings['reverse_proxy'] is set to TRUE;
- and $settings['reverse_proxy_header'] is set;
- and $settings['reverse_proxy_addresses'] is configured.
If your configuration meets all three criteria simultaneously, you need to verify how Drupal determines the client IP address.
How to verify:
It can be checked by sending a request from a non-trusted proxy/server like:
curl -I -H "X-REVERSE-PROXY-HEADER-NAME:8.8.8.8" your-hostname/some-path`
If Drupal detects the client IP address (for example, at the dblog report), everything works as expected.
If Drupal detects the client IP address as 8.8.8.8, you may need to check your $settings['reverse_proxy_addresses'] and/or review the documentation in the README file about $settings['reverse_proxy_header_trusted_addresses_ignore'].
Reccomendation:
Although it is not required to have $settings['reverse_proxy_addresses'] (Drupal Core setting) configured, it's always preferred to do so to improve security.
Reported By:- Pierre Rudloff (prudloff) provisional member of the Drupal Security Team
- Bohdan Artemchuk (bohart)
- Drew Webber (mcdruid) of the Drupal Security Team
- Pierre Rudloff (prudloff) provisional member of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) provisional member of the Drupal Security Team
Currency - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-110
This module allows you to use different currencies on your website and do currency conversion.
The module doesn't sufficiently protect routes used to enable and disable currencies from Cross-Site Request Forgery (CSRF) attacks, potentially allowing an attacker to trick an admin into changing settings.
Solution:Install the latest version:
- If you use the Currency module for Drupal, upgrade to Currency 8.x-3.5
- Juraj Nemec (poker10) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109
This module enables you to add Umami Analytics web statistics tracking system to your website.
The "administer umami analytics" permission allows inserting an arbitrary JavaScript file on every page. While this is an expected feature, the permission lacks the "restrict access" flag, which should alert administrators that this permission is potentially dangerous and can lead to cross-site scripting (XSS) vulnerabilities.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer umami analytics”.
Solution:Install the latest version:
- If you use the Umami Analytics module upgrade to Umami Analytics 1.0.1 or 2.0.-beta3
Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission.
Reported By: Fixed By: Coordinated By:- Damien McKenna (damienmckenna) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) provisional member of Drupal Security Team
Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108
This module enables users to sign in with an access code instead of entering user names and passwords. When users are allowed to pick their own access codes, they can guess other users' access codes based on the fact that access codes need to be unique and the system warns if the code of their choice is taken.
This vulnerability is mitigated by the fact that an attacker must have a role with the "change own access code" permission.
Solution:Install the latest version:
- If you use access_code module for Drupal, upgrade to access_code 2.0.5
- Greg Knaddison (greggles) of the Drupal Security Team
- Pierre Rudloff (prudloff) provisional member of the Drupal Security Team
Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107
This module integrates Plausible Analytics on a site.
The module did not properly filter output in certain cases.
This vulnerability is mitigated by the fact that an attacker must have permission to add raw HTML to the website, such as an unfiltered WYSIWYG field on a public-facing comment.
Solution:Install the latest version:
- If you use the Plausible Analytics module for Drupal, upgrade to Plausible Analytics v1.0.2
- Damien McKenna (damienmckenna) of the Drupal Security Team
JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106
This module enables you to store and display JSON data using optional 3rd party libraries.
The module doesn't sufficiently filter data using some of the included field formatters leading to a Cross-site Scripting (XSS) vulnerability.
Solution:Install the latest version:
- If you use the JSON Field module for Drupal 8.x, upgrade to JSON Field 8.x-1.5.
- Ivan (chi)
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105
This module enables you to connect a Drupal site to the Acquia DAM service, which syncs media from the third party service to the site.
The module doesn't sufficiently validate authorization to a list of DAM assets currently synced to the website creating an access bypass vulnerability.
This vulnerability is mitigated by the fact that it only impacts sites where users having the “view media” permission accessing any DAM asset is undesirable.
CVSS risk score (experimental) 6.9 / Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Solution:Install the latest version which will automatically reset three views to have permission-based access control based on the "access media overview" permission. If you have modified the view access in some other way you will need to redo that modification after upgrading the module.
- If you use the acquia_dam module for Drupal 8.x, upgrade to acquia_dam 1.1.5
Sites that cannot update to this code can mitigate the issue by modifying three views to be restricted to that permission: Acquia DAM Asset Library, Acquia DAM links, DAM Content Overview.
Reported By: Fixed By:- Chris Burge (chris burge)
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Jakob P (japerry)
- Todd Woofenden (toddwoof)
- cilefen (cilefen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Cathy Theys (yesct) of the Drupal Security Team
Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101
This module enables you to protect individual pages with a password.
The module doesn't limit the number of password attempts, making it vulnerable to brute force attacks.
This vulnerability is mitigated by the fact that an attacker must know the protected page's URL.
CVSS risk score (experimental) 6.3 / Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Solution:Install the latest version:
- If you use the Protected Pages module for Drupal 8.x, upgrade to Protected Pages 8.x-1.8
- Benji Fisher (benjifisher) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100
This module enables you to to easily create and manage faceted search interfaces.
The module doesn’t sufficiently filter certain user-provided text leading to a cross site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer facets”.
CVSS risk score (experimental) 4.8 / Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N
Solution:Install the latest version:
- If you use the Facets module for Drupal 8.x or higher, upgrade to Facets 2.0.10 or Facets 3.0.1
- Joris Vercammen (borisson_)
- Thomas Seidl (drunken monkey)
- Pierre Rudloff (prudloff), provisional member of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
- Pierre Rudloff (prudloff), provisional member of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099
This module enables you to to easily create and manage faceted search interfaces.
The module doesn't sufficiently check access to entities when they are displayed as facets.
This vulnerability is mitigated by the fact that only sites that show facets with entity labels (like taxonomy terms) are affected, and only if some of those entities are unpublished or have other access restrictions.
CVSS risk score (experimental) 6.9 / Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Solution:Install the latest version:
- If you use the Facets module for Drupal 8.x or higher, upgrade to Facets 2.0.10 or Facets 3.0.1
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Benji Fisher (benjifisher) of the Drupal Security Team
- Joris Vercammen (borisson_)
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Thomas Seidl (drunken monkey)
- Jimmy Henderickx (strykaizer)
- Benji Fisher (benjifisher) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Cathy Theys (yesct) of the Drupal Security Team
Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098
This module allows users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security.
The module did not protect all possible login paths provided by core modules.
CVSS risk score (experimental) 6.3 / Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Solution:Install the latest version:
- If you use the Alogin module for Drupal 10^, upgrade to Alogin 2.1.8
- Ahmed Raza (ahmed.raza)
- Pierre Rudloff (prudloff), provisional member of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Cathy Theys (yesct) of the Drupal Security Team
Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097
The Layout Builder Advanced Permissions module enables you to have fine grained control over who can do what in editing pages built with Layout Builder.
The module doesn't sufficiently control access for adding sections in the submodule.
This vulnerability is mitigated by the fact that an attacker must have a role with a specific set of permissions:
- Node: View published content
- Node: (Your content type): Create new content
- Node: (Your content type): Edit any content
- Layout builder: (Your content type): Configure layout overrides for content items that the user can edit
- Layout builder advanced permissions: Access Layout Builder page
Install the latest version:
- If you use the Layout Builder Advanced Permissions module, upgrade to Layout Builder Advanced Permissions 2.2.1
- Anna Kalata (akalata)
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Cathy Theys (yesct) of the Drupal Security Team
Authenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096
This module enables users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security. The module alters the standard Drupal login form to use AJAX callbacks for handling authentication flow.
The module doesn't sufficiently validate authentication under specific conditions, allowing an attacker to log in as any account where they know the username.
This vulnerability is mitigated by the fact that an attacker must make a series of requests to trigger the necessary conditions that allow authentication byass. The series of requests could alert a site owner that they are being attacked; however, the number of requests necessary to trigger the conditions is usually quite small (the number depends on site configuration, by default it is 5).
Solution:Install the latest version:
- If you use the alogin module for Drupal 10^, upgrade to the latest version or at least Alogin 2.1.5
Note: the fix is in a tag in git for 2.1.4 however there is no release for that tag. The fix is also in 2.1.5 release.
Reported By: Fixed By: Coordinated By:- Damien McKenna (damienmckenna) of the Drupal Security Team
- Dan Smith (galooph) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Cathy Theys (yesct) of the Drupal Security Team
AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095
This module enables you to provide SEO analysis and recommendations for a given URL.
The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery (SSRF) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access seo analyzer".
Solution:Install the latest version:
- If you use the AI SEO Link Advisor module 1.0.x, upgrade to AI SEO Link Advisor 1.0.6
- Benji Fisher (benjifisher) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094
This module enables you to integrate Google Tag Manager (GTM) into your Drupal site by allowing administrators to configure and embed GTM container snippets.
The module doesn't sufficiently sanitize the GTM container ID under the scenario where a user with the Administer gtm permission enters malicious input into the GTM-ID field. This value is directly inserted into a <script> tag, making the site vulnerable to Cross-site Scripting (XSS) attacks.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission Administer gtm, and the input field is limited to 20 characters.
Solution:Install the latest version:
If you use the Google Tag Manager module for Drupal 8.x, upgrade to Google Tag Manager 8.x-1.10.
The new version includes validation to prevent injection and restricts risky inputs.
Additionally, site administrators should review which roles have the Administer gtm permission at /admin/people/permissions.
Reported By:- Pierre Rudloff (prudloff), provisional member of the Drupal Security Team
- Anatoly Politsin (apolitsin)
- Pierre Rudloff (prudloff), provisional member of the Drupal Security Team
- Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093
This module enables you to access an edit page for a config page.
The module doesn't sufficiently check the access permissions (hook_ENTITY_TYPE_access() wasn't taken into account).
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit ID config page" and that it only affects sites that have access restricted via the hook_ENTITY_TYPE_access() hook.
Solution:Install the latest version:
- If you use the Config Pages module, upgrade to Config Pages 8.x-2.18.
- Pierre Rudloff (prudloff), provisional member of the Drupal Security Team
- Pierre Rudloff (prudloff), provisional member of the Drupal Security Team
- Alexander Shumenko (shumer)
- Greg Knaddison (greggles) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
COOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092
This module allows you to manage video media items using the COOKiES module (disabling external video elements). These elements will be enabled again, once the COOKiES banner is accepted.
The module doesn't sufficiently check whether to convert "data-src" attributes to "src" when their value might contain malicious content under the scenario, that module specific classes are set on the HTML element.
This vulnerability is mitigated by the fact that an attacker must have the correct permissions to have a specific HTML element display for all users, and this HTML element needs to have a specific class set.
Solution:Install the latest version:
- If you use the COOKiES Video submodule for Drupal upgrade to COOKiES 1.2.16
- Pierre Rudloff (prudloff) provisional member of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) provisional member of the Drupal Security Team
- Cathy Theys (yesct) of the Drupal Security Team
