Skip to content
OpenAdvisories
Medium WID-SEC-2026-2181 5 CVEs

Drupal Extensions: Mehrere Schwachstellen

Published Jul 1, 2026 · Updated Jul 12, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 5

  • Medium 6.1
    CVE-2026-58587

    Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.…

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 6.1
    CVE-2026-58588

    Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.…

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 5.4
    CVE-2026-58589

    FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

    Drupal FlowDrop drupal/flowdrop Packagist
  • Medium 5.4
    CVE-2026-58590

    FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

    Drupal FlowDrop drupal/flowdrop Packagist
  • Medium 5.4
    CVE-2026-58591

    Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.

    Drupal Colorbox drupal/colorbox Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-43073, EUVD-2026-43072, EUVD-2026-43071, EUVD-2026-43069, EUVD-2026-43070

  2. #1

    Initiale Fassung

References