CVE-2026-108515: Drupal core, XSS

Описание

Оригинално описание

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

Засегнати продукти

• Drupal Drupal core: 8.9.0 преди 10.6.19; 11.0.0 преди 11.3.19; 11.4.0 преди 11.4.10; 12.0.0-alpha1 преди 12.0.0-beta2

Вид слабост

• CWE-79 XSS

История

Други уязвимости в Drupal Drupal core

• CVE-2026-108097
• CVE-2026-108514
• 4.2CVE-2026-15916
• 4.7CVE-2026-15917
• 5.4CVE-2026-55805

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-108515
• https://nvd.nist.gov/vuln/detail/CVE-2026-108515
• https://www.drupal.org/sa-core-2026-015