DRUPAL-CORE-2023-003

At a glance

Published: 2023-03-15 16:24 UTC
Updated: 2026-09-19 15:46 UTC

Description

The language module provides a Language switcher block which can be placed to provide links to quickly switch between different languages. The URL of unpublished translations may be disclosed. When used in conjunction with a module like Pathauto, this may reveal the title of unpublished content. This advisory is not covered by [Drupal Steward](/steward).

Affected packages

Package	Versions
Packagist · drupal/core	introduced 8.0.0, fixed 9.4.12 ; introduced 9.5.0, fixed 9.5.5 ; introduced 10.0.0, fixed 10.0.5

References

https://www.drupal.org/sa-core-2023-003 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence