Skip to content
OpenAdvisories
High WID-SEC-2026-0530 9 CVEs

Drupal Extensions: Mehrere Schwachstellen

Published Feb 25, 2026 · Updated Mar 25, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Extensions ausnutzen, um Cross-Site-Scripting-Angriffe zu starten, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 9

  • Medium 6.5
    CVE-2026-3214

    CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.

    Drupal CAPTCHA drupal/captcha Packagist
  • Medium 6.1
    CVE-2026-3217

    SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 5.4
    CVE-2026-3212

    Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.

    Drupal Tagify drupal/tagify Packagist
  • Medium 5.4
    CVE-2026-3215

    Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.

    Drupal Islandora drupal/islandora Packagist
  • Medium 5.3
    CVE-2026-3210

    Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011

    Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.

    Drupal Material Icons drupal/material_icons Packagist
  • Medium 5.0
    CVE-2026-3216

    Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 4.8
    CVE-2026-3218

    Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.

    Drupal Responsive Favicons drupal/responsive_favicons Packagist
  • Medium 4.7
    CVE-2026-3213

    Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.

    Drupal Anti-Spam by CleanTalk drupal/cleantalk Packagist
  • Medium 4.3
    CVE-2026-3211

    Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.

    Drupal Theme Negotiation by Rules drupal/theme_rule Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-15479, EUVD-2026-15476, EUVD-2026-15474, EUVD-2026-15473, EUVD-2026-15471, EUVD-2026-15469, EUVD-2026-15467, EUVD-2026-15465, EUVD-2026-15477

  2. #1

    Initiale Fassung

References