Security advisories

The AI File to Text module extracts text from uploaded documents, including
Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool.

The module does not sufficiently check whether the current user is permitted
to view a file before extracting its contents. This allows the contents of files the user could not otherwise download, including files held in the private file system,
to be disclosed.

This module enables you to restrict user logins on a multi-domain site built with the Domain module, so that users can only log in on the domains assigned to them.

The module doesn't sufficiently enforce these restrictions when a user logs in by a method other than the standard login form.

This vulnerability is mitigated by the fact that an attacker must have a valid user account on the site, and the "Enable restriction" setting must be enabled on the Domain settings page. Users with the "Login to any domain" permission are not affected by the restriction.

This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image style download controller to serve them.

The module serves WebP image derivative responses with the HTTP header Cache-Control: public for all file schemes other than the private file system, including the temporary file system and access-controlled custom schemes. This can lead to some users getting cached versions of files with information they should not be able to access. For example, files may be cached by Varnish or a CDN.

This module allows for direct viewing of a file with the URL alias.

In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access.

This vulnerability is mitigated by the following:

This module enables users to upload files and create media items in bulk.

The module doesn't sufficiently check user permission to create specific media types if the bulk upload form is configured for that media type.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "bulk upload form".

This module enables editors to edit content, including paragraphs, directly on the rendered page.

The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields.

This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "access frontend editing", "add paragraphs"/"edit paragraphs"/"delete paragraphs" and also have access to update the parent entity the field belongs to.

This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation.

The module doesn't sufficiently check role delegation when approving users, and offers an Activate link for blocked administrators. It also doesn't protect user 1 from being deactivated or deleted.

This vulnerability is mitigated by the fact that an attacker must have a role with one of the module's additional action permissions.

This module allows healthcare professionals to log in to a shared account on the Drupal website using their DocCheck credentials.

The module doesn't sufficiently verify the authentication data with DocCheck API in some cases.

This module allows granting access to unpublished nodes per content type.

For nodes with at least one unpublished translation, the module grants every user with the "access content" permission view access to the published translations of that node. This overrides the restrictions of other node access modules, such as Content Access or Domain Access, that might have been in place for these translations.

Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events.

This module provides a route for displaying published content entities in a dialog. The route does not sufficiently verify the current user's access to the specific entity.

This vulnerability is mitigated by the fact that only rendered output is returned, and field-level access controls are still enforced.

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content.

The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whose download of the file is refused, can still read the file's contents on the page. A preview rendered for one visitor can also be cached and shown to another.

Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.

A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit.

This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.

The Dopup module provides functionality for selecting and working with Webforms.

The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms.

The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module.

The PHP formatter engine runs eval() to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about this behavior.

The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus.

The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes.

This vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles, either through menu administration or through content menu settings where permitted.

This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations.

The module doesn't sufficiently validate icon settings provided by users before they are rendered.

PHP has announced a critical PHP security release for Wednesday, October 21, 2026, at 14:00 UTC. Reserve time to update PHP as soon as the release is available. If you manage PHP yourself, you’ll need to apply the update. If your host manages it, follow their communications for timing and any required action.

Updating to a PHP release containing the patch to these vulnerabilities is the only complete mitigation.

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.

Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators.

The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes or the administer menu permission.

There will be a Drupal core security release for all supported branches on October 14, 2026 between 16:00 and 21:00 UTC. (To see this in your local timezone, refer to the Drupal Core Calendar.) Based on our analysis this vulnerability rates at 19/25 on our risk calculator.

The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days.

We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.

This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.

This module enables you to restrict access to routes by IP address.

The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic.

This module enables you to restrict view access to single nodes via taxonomy terms.

The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API.

This vulnerability is mitigated by the fact that it requires a specific module configuration, references to a deleted term, and access via JSON:API to be present.

This module enables you to show a breadcrumb trail for taxonomy term hierarchies.

The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment.

This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" (term_hierarchy) must be enabled, and at least one term has a term in the parent hierarchy that is unpublished.

This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to.

The module's search query did not respect entity access when returning results to the browser.

This vulnerability is mitigated by the fact that an user must have permission to use the AI CKEditor "Generate internal links" feature on a text format.