Skip to content
OpenAdvisories
Critical WID-SEC-2026-3819 26 CVEs

Drupal Erweiterungen: Mehrere Schwachstellen

Published Oct 8, 2026 · Updated Oct 29, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 26

  • Critical 9.8
    CVE-2026-107249

    Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

    Drupal Block AJAX drupal/block_ajax Packagist
  • High 7.3
    CVE-2026-107255

    Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216

    Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.

    Drupal Restrict route by IP drupal/restrict_route_by_ip Packagist
  • Medium 6.5
    CVE-2026-107251

    Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

    Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

    Drupal Entity Reference Manager (Merge entities) drupal/entity_reference_manager Packagist
  • Medium 6.5
    CVE-2026-107257

    Actstream - Critical - Access bypass - SA-CONTRIB-2026-198

    Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

    Drupal Actstream drupal/actstream Packagist
  • Medium 6.5
    CVE-2026-96389

    Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

    Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

    Drupal Xray Audit drupal/xray_audit Packagist
  • Medium 5.9
    CVE-2026-107250

    ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193

    Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.

    Drupal ECA Helper drupal/eca_helper Packagist
  • Medium 5.9
    CVE-2026-107253

    Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196

    Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.

    Drupal Orphans Media drupal/orphans_media Packagist
  • Medium 5.4
    CVE-2026-107252

    MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.

    Drupal MathJax: LaTeX for Drupal drupal/mathjax Web / CMS Packagist
  • Medium 5.4
    CVE-2026-107258

    Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

    Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.

    Drupal Inline Entity Form Dialog drupal/inline_entity_form_dialog Packagist
  • Medium 5.4
    CVE-2026-107259

    Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.

    Drupal Linked Field drupal/linked_field Packagist
  • Medium 5.4
    CVE-2026-107263

    Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

    Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

    Drupal Gutenberg drupal/gutenberg Packagist
  • Medium 5.4
    CVE-2026-107264

    Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.

    Drupal Inline Formatter Field drupal/inline_formatter_field Packagist
  • Medium 5.4
    CVE-2026-107265

    Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.

    Drupal Leaflet drupal/leaflet Packagist
  • Medium 5.3
    CVE-2026-107262

    Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.

    Drupal Advanced Filesystem drupal/advanced_filesystem Packagist
  • Medium 5.3
    CVE-2026-107266

    Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205

    Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.

    Drupal Views Share drupal/views_share Packagist
  • Medium 5.3
    CVE-2026-107267

    DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

    Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

    Drupal DKAN drupal/dkan Packagist
  • Medium 4.8
    CVE-2026-107254

    Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

    Drupal Authenticator Login Plus (2FA) drupal/auth_login_plus Packagist
  • Medium 4.3
    CVE-2026-107268 Public exploit

    Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, fro…

    Drupal Two Factor Authentication - TFA / Passwordless Login drupal/miniorange_2fa Packagist
  • Medium 4.3
    CVE-2026-107307

    SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

    Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

    Drupal SmartLinker AI drupal/smartlinker_ai Packagist
  • Medium 4.3
    CVE-2026-107310

    Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.

    Drupal Freelinking drupal/freelinking Packagist
  • Medium 4.3
    CVE-2026-107312

    Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.

    Drupal Examples for Developers drupal/examples Packagist
  • Medium 4.2
    CVE-2026-107261

    Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

    Drupal Authenticator Login Plus (2FA) drupal/auth_login_plus Packagist
  • Low 3.8
    CVE-2026-107306

    Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

    Drupal Menu Link Attributes drupal/menu_link_attributes Packagist
  • Low 3.7
    CVE-2026-107309

    Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

    Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

    Drupal Easy Breadcrumb drupal/easy_breadcrumb Packagist
  • Low 3.7
    CVE-2026-107311

    Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

    Drupal Permissions by Term drupal/permissions_by_term Packagist
  • Low 3.1
    CVE-2026-107308

    Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

    Drupal Country drupal/country Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-113563, EUVD-2026-113562, EUVD-2026-113561, EUVD-2026-113560, EUVD-2026-113559, EUVD-2026-113558, EUVD-2026-113583, EUVD-2026-113580, EUVD-2026-113582, EUVD-2026-113579, EUVD-2026-113578, EUVD-2026-113577, EUVD-2026-113575, EUVD-2026-113576, EUVD-2026-113574, EUVD-2026-113573, EUVD-2026-113572, EUVD-2026-113570, EUVD-2026-113569, EUVD-2026-113568, EUVD-2026-113567, EUVD-2026-113566, EUVD-2026-113565, EUVD-2026-113564, EUVD-2026-113581, EUVD-2026-113571

  2. #1

    Initiale Fassung

References