Skip to content
OpenAdvisories
Low · 3.7 CVE-2026-114547 DRUPAL-CONTRIB-2026-246EUVD-2026-113526GHSA-gjp5-2v9x-wg6m

TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246

Published Oct 30, 2026 · Updated Nov 6, 2026 · Assigned by drupal

Vendor: Drupal Product: TinyPNG Package: drupal/tinypng Ecosystem: Packagist

Description

Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.

Affected products

VendorProductAffectedFixed
Drupal TinyPNG 0.0.0 – < 2.0.2 2.0.2

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/tinypng < 2.0.2 2.0.2 DRUPAL-CONTRIB-2026-246

Advisories 1

References