Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files.
The Islandora Text Extraction submodule also bypasses shared destination URI and file extension validation when attaching OCR output.
This vulnerability is mitigated by the fact that an attacker must have permission to update media or to update a node and create media.
The Mime Mail module gives Drupal sites the ability to send HTML email messages.
Under rare site configuration conditions, a user with the ability to send HTML emails could send non-public data that had been uploaded to the files directory,
This vulnerability is mitigated by the fact the attacker would need advance knowledge of uploaded files, and to send HTML emails and set the recipient list.
This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site.
The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have permission to add or edit content that is configured to use the module's functionality.
The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module.
The module doesn't properly validate data, resulting in an SQL Injection vulnerability. An attacker can use this to read data from the Drupal database, including user account data.
The vulnerability is mitigated by the fact that an attacker must be logged in and hold the Create translation jobs permission provided by TMGMT.
The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language.
The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create content in at least one language.
This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one.
The module doesn't sufficiently verify the current password in some cases.
This vulnerability is mitigated by the fact that an attacker must already have access to the victim's authenticated session (for example an unattended browser or a stolen session cookie). It allows that temporary session access to be turned into a persistent account takeover.
This module enables you to schedule content to be published or unpublished at a certain time in the future.
The module doesn't sufficiently check if a user has permission to change publication or unpublication dates. This might cause certain information to be publicly disclosed ahead of the scheduled time, or content to become inaccessible earlier or later than planned.
This vulnerability is mitigated by the fact that an attacker must already have permission to edit the affected content, and the content must be editable through a web services API like JSON:API or REST.
This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links.
The module doesn't sufficiently validate resetting passwords for blocked users.
This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the affected user for the attacker to use the new password.
The Name Field module provides a field for storing a personal name as separate components.
The module does not sufficiently sanitize values under some circumstances. A name stored on the field can be interpreted as HTML, which can lead to a cross-site scripting (XSS) vulnerability.
This module allows forums to be set private and to be given moderators.
The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access.
This vulnerability is mitigated by the fact that the vulnerability only exists where the forum field for the forum topic is not using the default select widget, or when content is created through a web services API.
This module enables you to accept payments through Escrow.com with Drupal Commerce.
The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress.
This module lets customers replace an item in their cart with one of the alternative product variations listed for it.
The module does not check that a cart belongs to the current visitor when the visitor is not logged in. An anonymous visitor can view items in other anonymous visitors' carts, including product names and prices, and replace those items with one of their listed alternatives.
The vulnerability is mitigated by the fact that only carts of anonymous visitors are affected; carts of authenticated customers are not.
The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal.
The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causing the associated order to be marked as paid without completing a payment.
This module enables you to add syntax-highlighted code snippets to content using CKEditor 5.
The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting (XSS) vulnerability.
The REST & JSON API Authentication module provides API authentication for Drupal sites.
The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated.
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them.
The module doesn't sufficiently restrict access to consumer configuration. Users who can create or edit consumers can potentially configure malicious consumers and obtain tokens with additional privileges. This can allow them to access the site as another user, up to full administrative access.
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.
The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.
A maliciously crafted import file can cause untrusted data to be deserialized (PHP Object Injection, CWE-502), potentially leading to remote code execution.
This module allows for direct viewing of a file with the URL alias.
This is a followup advisory to SA-CONTRIB-2026-245, which did not fully resolve the underlying vulnerability.
In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access.
This module enables you to share and reuse content across websites.
The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password.
This vulnerability is mitigated by the fact that an attacker must have access to a database dump or database read access to the user data table. This vulnerability is not exploitable without prior database access.
This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback.
The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration to an account they control.
This vulnerability is mitigated by the fact that an attacker must obtain the OAuth2 state value from a previous system token initialization (for example, from the server access logs).
The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting.
The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author (user account or owner). As a result, a field configured as "Private" on one of these entities can be viewed. Where the entity is editable, the entity can also be edited by anyone who can view it, including anonymous users.
This module enables you to set field-level permissions to create, update or view individual fields.
The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access restrictions and gain unauthorized view and edit access to protected fields.
The module enables authentication via the OpenID Connect (oAuth2) protocol.
When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user.
This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.
Stage File Proxy is a general solution for getting production files on a development server on demand. It is not intended for usage on production sites.
The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scripting vulnerability.
This vulnerability is mitigated by the fact this development module must be enabled on an attacker's target site, and the attacker must be able to upload a malicious file to the "origin" server configured for the module.
This module enables users to create and save signatures as SVG images.
The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a cross-site scripting (XSS) vulnerability.
This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity provider.
The module doesn't sufficiently check access on a configuration route, or check whether the identity provider has verified the email address it returns. Together, these let an attacker log in as any existing user whose email address they know.
S3 File System (s3fs) provides an additional file system to your Drupal site that stores files in Amazon's Simple Storage Service (S3) storage.
The module doesn't sufficiently isolate upload context between separate object(file) operations in the same request resulting in the potential for objects to be uploaded with incorrect access control list (ACL) entries or corruption through incorrect operation metadata.
This vulnerability is mitigated by the fact that an attacker must be able to trigger multiple file operations on S3FS.
This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page.
The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its toggle URL, under the scenario where a user with the "Use Fasttoggle" permission visits a page controlled by an attacker while logged in. This allows the attacker to change the publication status of arbitrary content on behalf of that user.
This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page.
The module doesn't sufficiently check access to the entity being toggled, under the scenario where a user with the "Use Fasttoggle" permission submits a request to the toggle URL for any node or comment regardless of their permission to update that entity. For example, such a user could publish an unpublished draft they are not allowed to view.
The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved.
The module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted once can be submitted again without solving a new CAPTCHA. This weakens the protection the module provides against automated submissions such as spam registrations, comment spam, and login brute-forcing.
Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites.
The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the web server, or cause the server to make requests to internal or external resources. Depending on the server configuration, this may lead to remote code execution.
This module provides a framework for integrating AI providers and features into Drupal.
Audio for every speech-to-text request is written to the same file in the temporary directory and does not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get the audio that another user sent for transcription.
This module provides a framework for integrating Drupal with AI providers. Its AI Search submodule provides a Search API backend that stores content in a vector database for semantic search.
The AI Search submodule has always been marked as 'experimental' but more importantly is deprecated. You may wish to use this as an opportunity to move to the standalone AI Search which is a drop-in replacement and target of all new development. It also had the same vulnerability.
This AI module enables you to interact with AI providers. It has a service that helps any consumer of the module to stop cross site scripting elements from appearing.
The module does not sufficiently validate Markdown links under certain conditions, potentially allowing cross-site scripting (XSS).
This module enables you to use AI on the website. It also enables you to interact with AI providers.
The module does not sufficiently validate links under certain conditions, potentially allowing the exfiltration of sensitive information to external sites.
This vulnerability is mitigated by the fact that an attacker must use untrusted sources when interacting with the AI module in a way that produces rendered HTML.
This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot.
Under certain configurations, the chatbot does not sufficiently filter user input before rendering it, potentially allowing cross-site scripting (XSS).
This vulnerability is mitigated by the fact that an attacker must have access to administer blocks.
