This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a Search - autocomplete widget.
The module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can allow cross-site scripting.
This vulnerability is mitigated by the fact that the attacker must have permission to edit an entity carrying a Data Field field. The Search - autocomplete widget must also be configured on that field.
This module adds large file, multiple file, and resumable uploads to the File and Image field widgets.
The module doesn't sufficiently check access to resumable upload forms. This allows an unauthenticated user to start uploads against forms they are not permitted to use, and to store partial upload data on the server.
This vulnerability is mitigated by the fact that partial upload data is only attached to content through the normal entity form, which enforces its own access checks, and that stored partial upload data is not executable by the web server.
The S3 File System CORS Upload module lets users upload files straight from the browser to Amazon S3 (or an S3-compatible service), using a file widget on entity forms.
The module doesn't sufficiently restrict the upload permission it gives the browser. A user who can upload through the widget can overwrite other files already stored in the bucket, including files they couldn't otherwise replace.
This vulnerability is mitigated by the fact that an attacker must have access to a form that uses the S3 File System CORS Upload widget.
This module enables you to display users by a configurable "real name" pattern built from tokens, instead of by their username.
The module does not sufficiently sanitize user input used in name patterns.
A user can place Twig syntax in their own profile data and have it evaluated when their name is displayed.
This vulnerability is mitigated by the fact that the site must be configured with a real name pattern that includes user-supplied data, and the attacker must be able to edit that data on their own account.
This module renders Layout Builder forms inside an iframe in a modal dialog, using the admin theme.
The module provides its own Ajax command to open the iframe dialog. This command does not sanitize the dialog options the same way Drupal core does since SA-CORE-2026-001, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must be able to control the Ajax response, or be able to add markup with specific attributes to a page.
This module enables you to manage user consent for external services, such as embedded videos. The COOKiES Video submodule blocks external video elements until the visitor accepts the consent banner, then re-enables them.
This module implements a field formatter for text fields that improves the Summary or Trimmed formatter built into Drupal core.
The module doesn't sufficiently escape unsafe HTML when passed through the module's Twig filter.
This vulnerability is mitigated by the fact that an attacker must have a role with the ability to post content that gets passed through a Twig template with one of the |smart_trim_* filters provided by this module.
This module tracks file downloads for private files and provides reports about them.
The module provides the permissions that are never actually checked. A user with only the View download counts permission could export the download log and delete all download records.
This vulnerability is mitigated by the fact that an attacker must have an account with the View download counts permission.
This module enables you to create custom pages and to override existing paths, such as node or user pages, with variants that are selected by conditions.
The Page Manager UI submodule doesn't sufficiently protect against cross-site request forgery (CSRF). An attacker could trick a user with permission to administer pages into enabling or disabling a page without their knowledge.
This vulnerability is mitigated by the fact that the Page Manager UI submodule must be enabled, and the targeted user must have the "administer pages" permission.
This module enables you to print and export Drupal entities to PDF and other formats, using print engines such as Dompdf.
When generating a PDF for a page that contains third-party resources, the module sends several kinds of private data to the third-party server (including the user's session cookie and their Dompdf HTTP authentication credentials), regardless of the host those resources are loaded from. A third-party site referenced in printed content can therefore obtain the session data of users printing that content and use it to impersonate them.
This module integrates the Campaign Monitor API into Drupal so that users can subscribe and unsubscribe for your Campaign Monitor. It manages lists through a block on your Drupal site.
The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its admin routes.
This vulnerability is mitigated by the fact that an attacker must craft and embed into a Drupal site a link with exact ID of a Campaign Monitor list for user with administer campaignmonitor permission to click.
This module enables you to sell licenses (such as roles or files) using Drupal Commerce.
The module doesn't sufficiently validate license order items, which under certain conditions could allow a customer to obtain a license without paying its full price.
This vulnerability is mitigated by the fact that the site must expose order items to modification outside of the standard cart form.
This module enables you to require a second authentication factor (a time-based one-time password from an authenticator app) when users log in.
Under certain circumstances, an attacker can make the module treat a login as having passed the password check when it did not, or reach the two-factor setup page of another account. Depending on the site's configuration, this can allow the attacker to take over an account that has 2FA enabled without knowing its password or its second factor.
This module enables you to require a second authentication factor (a time-based one-time password from an authenticator app) when users log in.
The module does not enforce the second authentication factor correctly. As a result, an attacker who has only the first factor for an account with 2FA (for example, a valid one-time login link) could trigger actions that should only follow a fully authenticated login. These include updating the account's last login time, (which also invalidates other one-time login links) and running other modules' login hooks.
This module enables you to require a second authentication factor (a time-based one-time password from an authenticator app) when users log in.
The module doesn't sufficiently enforce the second factor for authentication providers that authenticate every request on their own. An attacker who knows the password of an account with two-factor authentication enabled can use that account's permissions through routes that accept such a provider, without providing the second factor.
The Texts module provides key-based strings and translations for Drupal and tools for managing them.
The module does not sufficiently protect an action to restore a duplicate translation. A crafted request can cause a user with access to the translation overview to overwrite an existing translation and delete the duplicate, even if that user cannot edit or delete translations.
This vulnerability is mitigated by the fact that an attacker must first create a suitable duplicate translation and induce a user with access to the translation overview to open the crafted request.
The Texts module provides key-based strings and translations for Drupal, including Twig filters for displaying translated text.
The module does not sufficiently validate translation HTML and can display stored translations without sufficient filtering. A user who can create or edit string translations could inject JavaScript into pages that render those translations.
Paragraphs Edit adds contextual edit, clone, and delete links, along with the required routes, to individual Paragraphs.
The module doesn't sufficiently check access on the edit and delete routes for a paragraph.
This vulnerability is mitigated by the fact that an attacker must have an account on the site and must know or guess the ID of the paragraph. No special permission is required.
This module provides a configurable GraphQL schema generator for Drupal entities and fields, along with optional schema extensions for common tasks such as user login and password management.
The module doesn't sufficiently check access when changing a user's password through the GraphQL API. A user who can view another user's account can change that account's password, including on administrator accounts. This can lead to a full account takeover.
This vulnerability is mitigated by the fact that the User Login schema extension must be enabled on a GraphQL server.
Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files.
The Islandora Text Extraction submodule also bypasses shared destination URI and file extension validation when attaching OCR output.
This vulnerability is mitigated by the fact that an attacker must have permission to update media or to update a node and create media.
The Mime Mail module gives Drupal sites the ability to send HTML email messages.
Under rare site configuration conditions, a user with the ability to send HTML emails could send non-public data that had been uploaded to the files directory,
This vulnerability is mitigated by the fact the attacker would need advance knowledge of uploaded files, and to send HTML emails and set the recipient list.
This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site.
The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have permission to add or edit content that is configured to use the module's functionality.
The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module.
The module doesn't properly validate data, resulting in an SQL Injection vulnerability. An attacker can use this to read data from the Drupal database, including user account data.
The vulnerability is mitigated by the fact that an attacker must be logged in and hold the Create translation jobs permission provided by TMGMT.
The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language.
The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create content in at least one language.
This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one.
The module doesn't sufficiently verify the current password in some cases.
This vulnerability is mitigated by the fact that an attacker must already have access to the victim's authenticated session (for example an unattended browser or a stolen session cookie). It allows that temporary session access to be turned into a persistent account takeover.
This module enables you to schedule content to be published or unpublished at a certain time in the future.
The module doesn't sufficiently check if a user has permission to change publication or unpublication dates. This might cause certain information to be publicly disclosed ahead of the scheduled time, or content to become inaccessible earlier or later than planned.
This vulnerability is mitigated by the fact that an attacker must already have permission to edit the affected content, and the content must be editable through a web services API like JSON:API or REST.
This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links.
The module doesn't sufficiently validate resetting passwords for blocked users.
This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the affected user for the attacker to use the new password.
The Name Field module provides a field for storing a personal name as separate components.
The module does not sufficiently sanitize values under some circumstances. A name stored on the field can be interpreted as HTML, which can lead to a cross-site scripting (XSS) vulnerability.
This module allows forums to be set private and to be given moderators.
The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access.
This vulnerability is mitigated by the fact that the vulnerability only exists where the forum field for the forum topic is not using the default select widget, or when content is created through a web services API.
This module enables you to accept payments through Escrow.com with Drupal Commerce.
The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress.
This module lets customers replace an item in their cart with one of the alternative product variations listed for it.
The module does not check that a cart belongs to the current visitor when the visitor is not logged in. An anonymous visitor can view items in other anonymous visitors' carts, including product names and prices, and replace those items with one of their listed alternatives.
The vulnerability is mitigated by the fact that only carts of anonymous visitors are affected; carts of authenticated customers are not.
The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal.
The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causing the associated order to be marked as paid without completing a payment.
This module enables you to add syntax-highlighted code snippets to content using CKEditor 5.
The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting (XSS) vulnerability.
The REST & JSON API Authentication module provides API authentication for Drupal sites.
The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated.
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them.
The module doesn't sufficiently restrict access to consumer configuration. Users who can create or edit consumers can potentially configure malicious consumers and obtain tokens with additional privileges. This can allow them to access the site as another user, up to full administrative access.
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.
The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.
A maliciously crafted import file can cause untrusted data to be deserialized (PHP Object Injection, CWE-502), potentially leading to remote code execution.
This module allows for direct viewing of a file with the URL alias.
This is a followup advisory to SA-CONTRIB-2026-245, which did not fully resolve the underlying vulnerability.
In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access.
