Cross-Site Scripting Vulnerability in Drupal Core by Drupal
CVE-2026-108515

Currently unrated

Key Information:

Vendor

Drupal
Status
Drupal Core
Vendor
CVE Published:
30 October 2026

What is CVE-2026-108515?

The vulnerability allows attackers to inject malicious scripts into web pages, affecting users who visit the compromised pages. Drupal core is vulnerable due to improper neutralization of input during the web page generation process. This can lead to significant security issues, including unauthorized access to sensitive information and session hijacking. It is critical for users of affected Drupal versions to apply updates promptly to safeguard their sites against potential attacks.

Affected Version(s)

Drupal core 8.9.0 < 10.6.19

Drupal core 11.0.0 < 11.3.19

Drupal core 11.4.0 < 11.4.10

References

https://www.drupal.org/sa-core-2026-015

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dev-winty
Benji Fisher (benjifisher)
catch (catch)
David Cameron (dcam)
Shawn Duncan (fathershawn)
Lee Rowlands (larowlan)
Drew Webber (mcdruid)
Mohit Aghera (mohit_aghera)
Jess (xjm)
Swan Kalata (akalata)
Benji Fisher (benjifisher)
Neil Drumm (drumm)
Greg Knaddison (greggles)
Dave Long (longwave)
James Gilliland (neclimdul)
Juraj Nemec (poker10)
Ra Mänd (ram4nd)
Jess (xjm)
.