Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1032 _____________________________________________________________________ DATE : 15/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Drupal core versions prior to 11.4.10, 11.3.19, 10.6.19. ==================================================================== https://www.drupal.org/sa-core-2026-014 https://www.drupal.org/sa-core-2026-015 https://www.drupal.org/sa-core-2026-016 _____________________________________________________________________ Drupal core - Critical - Remote code execution - SA-CORE-2026-014 Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default Vulnerability: Remote code execution Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108097 Description: A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality. The vulnerability can be mitigated by uninstalling the core Field UI module (field_ui), which will provide protection while sites are updated. Drupal Steward protection: This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered. Solution: Install the latest version: Drupal 11 If you use Drupal 11.4.x, update to Drupal 11.4.10. If you use Drupal 11.3.x, update to Drupal 11.3.19. Drupal 11.2.x and below are end-of-life and do not receive security coverage. Drupal 10 If you use Drupal 10.6.x, update to Drupal 10.6.19. Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 and Drupal 9 have both reached end-of-life. Reported By: Drew Webber (mcdruid) of the Drupal Security Team Octavio Galland (ogalland-tob) Fixed By: catch (catch) of the Drupal Security Team Lee Rowlands (larowlan) of the Drupal Security Team Dave Long (longwave) of the Drupal Security Team Drew Webber (mcdruid) of the Drupal Security Team Jess (xjm) of the Drupal Security Team Coordinated By: Swan Kalata (akalata) of the Drupal Security Team Bram Driesen (bramdriesen) of the Drupal Security Team catch (catch) of the Drupal Security Team Greg Knaddison (greggles) of the Drupal Security Team Tim Hestenes Lehnen (hestenet) Lee Rowlands (larowlan) of the Drupal Security Team Dave Long (longwave) of the Drupal Security Team Drew Webber (mcdruid) of the Drupal Security Team Juraj Nemec (poker10) of the Drupal Security Team Pierre Rudloff (prudloff) of the Drupal Security Team Jess (xjm) of the Drupal Security Team _____________________________________________________________________ Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108515 Description: The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities. Solution: Install the latest version: Drupal 11 If you use Drupal 11.4.x, update to Drupal 11.4.10. If you use Drupal 11.3.x, update to Drupal 11.3.19. Drupal 11.2.x and below are end-of-life and do not receive security coverage. Drupal 10 If you use Drupal 10.6.x, update to Drupal 10.6.19. Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 and Drupal 9 have both reached end-of-life. Reported By: dev-winty Fixed By: Benji Fisher (benjifisher) of the Drupal Security Team catch (catch) of the Drupal Security Team David Cameron (dcam) Shawn Duncan (fathershawn) Lee Rowlands (larowlan) of the Drupal Security Team Drew Webber (mcdruid) of the Drupal Security Team Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team Jess (xjm) of the Drupal Security Team Coordinated By: Swan Kalata (akalata) of the Drupal Security Team Benji Fisher (benjifisher) of the Drupal Security Team Neil Drumm (drumm) of the Drupal Security Team Greg Knaddison (greggles) of the Drupal Security Team Dave Long (longwave) of the Drupal Security Team James Gilliland (neclimdul) of the Drupal Security Team Juraj Nemec (poker10) of the Drupal Security Team Ra Mänd (ram4nd), provisional member of the Drupal Security Jess (xjm) of the Drupal Security Team _____________________________________________________________________ Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108514 Description: The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission. Solution: Install the latest version: Drupal 11 If you use Drupal 11.4.x, update to Drupal 11.4.10. If you use Drupal 11.3.x, update to Drupal 11.3.19. Drupal 11.2.x and below are end-of-life and do not receive security coverage. Drupal 10 If you use Drupal 10.6.x, update to Drupal 10.6.19. Drupal 10.5.x and below are end-of-life and do not receive security coverage. Drupal 8 and Drupal 9 have both reached end-of-life. Reported By: Eric Tee (erictee2802) haii haii (hai27ii2o) Fixed By: Benji Fisher (benjifisher) of the Drupal Security Team Jürgen Haas (jurgenhaas) Lee Rowlands (larowlan) of the Drupal Security Team Mingsong (mingsong), provisional member of the Drupal Security Mohit Aghera (mohit_aghera), provisional member of the Drupal Security Team James Gilliland (neclimdul) of the Drupal Security Team Pablo López (plopesc) Juraj Nemec (poker10) of the Drupal Security Team Pierre Rudloff (prudloff) of the Drupal Security Team Coordinated By: cilefen (cilefen) of the Drupal Security Team Lee Rowlands (larowlan) of the Drupal Security Team Dave Long (longwave) of the Drupal Security Team James Gilliland (neclimdul) of the Drupal Security Team Juraj Nemec (poker10) of the Drupal Security Team Pierre Rudloff (prudloff) of the Drupal Security Team Jess (xjm) of the Drupal Security Team ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================