Skip to content
OpenAdvisories
Medium WID-SEC-2026-1151 3 CVEs

Drupal Core: Mehrere Schwachstellen

Published Apr 15, 2026 · Updated May 19, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal Core ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 3

  • Medium 6.6
    CVE-2026-6366

    Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 1…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2026-6365

    Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2026-6367

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.

    Drupal Drupal core drupal/core Web / CMS Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-30999, EUVD-2026-31000, EUVD-2026-31002

  2. #1

    Initiale Fassung

References