DRUPAL-CORE-2025-007

At a glance

Published: 2025-11-12 20:16 UTC
Updated: 2025-12-10 23:41 UTC
CVE: CVE-2025-13082
Aliases: BIT-drupal-2025-13082, GHSA-h89p-5896-f4q8

Description

By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement. The defacement is not stored and is only present when the URL has been crafted for that purpose. Only the defacement is present, so no other site content (such as branding) is rendered.

Affected packages

Package	Versions
Packagist · drupal/core	introduced 8.0.0, fixed 10.4.9 ; introduced 10.5.0, fixed 10.5.6 ; introduced 11.0.0, fixed 11.1.9 ; introduced 11.2.0, fixed 11.2.8

References

https://www.drupal.org/sa-core-2025-007 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence