Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Project:
Date:
2025-September-24
Vulnerability:
Cross Site Request Forgery
Affected versions:
<3.5.0
CVE IDs:
CVE-2025-10930
Description:
This module allows you to use different currencies on your website and do currency conversion.
The module doesn't sufficiently protect routes used to enable and disable currencies from Cross-Site Request Forgery (CSRF) attacks, potentially allowing an attacker to trick an admin into changing settings.
Solution:
Install the latest version:
- If you use the Currency module for Drupal, upgrade to Currency 8.x-3.5
Reported By:
- Juraj Nemec (poker10) of the Drupal Security Team
Coordinated By:
- Juraj Nemec (poker10) of the Drupal Security Team
