Skip to content
OpenAdvisories
High WID-SEC-2026-3554 36 CVEs

Drupal Erweiterungen: Mehrere Schwachstellen

Published Sep 23, 2026 · Updated Oct 21, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 36

  • Critical 9.1
    CVE-2026-96355

    Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • High 7.5
    CVE-2026-96365

    Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 6.5
    CVE-2026-96380

    CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

    Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.

    Drupal CSS Usage Analyzer drupal/css_usage_analyzer Packagist
  • Medium 6.5
    CVE-2026-96385

    REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.

    Drupal REST & JSON API Authentication for Drupal drupal/rest_api_authentication Web / CMS Packagist
  • Medium 6.5
    CVE-2026-96386

    Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

    Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.

    Drupal Smart Content drupal/smart_content Packagist
  • Medium 6.4
    CVE-2026-96376

    Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.

    Drupal Cloud drupal/cloud Packagist
  • Medium 5.4
    CVE-2026-96370

    Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

    Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.4
    CVE-2026-96371

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.4
    CVE-2026-96372

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167

    Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.4
    CVE-2026-96388

    Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.

    Drupal Tawk.to - Live chat application drupal/tawk_to Packagist
  • Medium 5.3
    CVE-2026-96356

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.3
    CVE-2026-96364

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

    Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.3
    CVE-2026-96366

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.3
    CVE-2026-96377

    Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.

    Drupal Combined image style drupal/combined_image_style Packagist
  • Medium 4.8
    CVE-2026-96375

    Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

    Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.

    Drupal Cloud drupal/cloud Packagist
  • Medium 4.6
    CVE-2026-96357

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96358

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96359

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96361

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96367

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96368

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96382

    Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2.

    Drupal Diba carousel slider drupal/diba_carousel Packagist
  • Medium 4.3
    CVE-2026-96378

    Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.

    Drupal Commerce Decoupled Checkout drupal/commerce_decoupled_checkout Packagist
  • Medium 4.3
    CVE-2026-96390

    Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

    Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.

    Drupal Editoria11y Accessibility Checker drupal/editoria11y Packagist
  • Medium 4.3
    CVE-2026-96391

    Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

    Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

    Drupal Webform REST drupal/webform_rest Packagist
  • Medium 4.3
    CVE-2026-96398

    Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.2
    CVE-2026-96362

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.2
    CVE-2026-96374

    Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.

    Drupal Project Browser drupal/project_browser Packagist
  • Low 3.8
    CVE-2026-96387

    Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.

    Drupal Stop administrator login drupal/stop_admin Packagist
  • Low 3.5
    CVE-2026-96360

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Low 3.5
    CVE-2026-96379

    CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.

    Drupal CookieCuttr drupal/cookiecuttr Packagist
  • Low 3.5
    CVE-2026-96384

    Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180

    Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.

    Drupal Mermaid Diagram Field drupal/mermaid_diagram_field Packagist
  • Low 3.5
    CVE-2026-96392

    AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.

    Drupal AI CKEditor drupal/ai_ckeditor Packagist
  • Low 3.3
    CVE-2026-96373

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Low 3.1
    CVE-2026-96363

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Low 3.1
    CVE-2026-96369

    Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-107845, EUVD-2026-107843, EUVD-2026-107842, EUVD-2026-107841, EUVD-2026-107839, EUVD-2026-107840, EUVD-2026-107838, EUVD-2026-107837, EUVD-2026-107836, EUVD-2026-107833, EUVD-2026-107835, EUVD-2026-107832, EUVD-2026-107831, EUVD-2026-107830, EUVD-2026-107829, EUVD-2026-107828, EUVD-2026-107827, EUVD-2026-107826, EUVD-2026-107825, EUVD-2026-107822, EUVD-2026-107823, EUVD-2026-107821, EUVD-2026-107820, EUVD-2026-107819, EUVD-2026-107818, EUVD-2026-107817, EUVD-2026-107816, EUVD-2026-107815, EUVD-2026-107813, EUVD-2026-107811, EUVD-2026-107812, EUVD-2026-107810, EUVD-2026-107844, EUVD-2026-107834, EUVD-2026-107824, EUVD-2026-107814

  2. #1

    Initiale Fassung

References