Drupal Issues 34 Contrib Security Advisories, Including Highly Critical RCE

Security advisories published by the Drupal Security Team on 21 October 2026 identified vulnerabilities across 31 contributed Drupal projects, including a Highly critical remote code execution flaw in Ffmpeg Image Toolkit. The batch comprises 34 advisories, numbered SA-CONTRIB-2026-220 through SA-CONTRIB-2026-253, with one Highly critical, seven Critical, 25 Moderately critical and one Less critical rating. The affected projects include modules, themes and a distribution.

The disclosures cover different security failures involving image processing, authentication, access control, file handling and user interfaces. Several projects received more than one advisory, while exploitation conditions and corrective versions vary by project and configuration. The accompanying security releases also show differences in declared Drupal 12 compatibility as the next major core release approaches.

Highly Critical RCE Affects Ffmpeg Image Toolkit

The most severe advisory, SA-CONTRIB-2026-220, concerns Ffmpeg Image Toolkit, a module that uses FFmpeg to process and convert images. Rated Highly critical at 20 out of 25, the vulnerability stems from insufficient sanitisation of filenames passed to the FFmpeg command-line tool. This could allow remote code execution, although exploitation requires an attacker to have permission to upload images to the affected website. Versions earlier than 1.0.3 are affected, and the Security Team recommends upgrading to Ffmpeg Image Toolkit 1.0.3.

Another code execution vulnerability affects Custom Formatters, rated Critical at 17 out of 25. The module allows administrators to create custom field formatters through a user interface, including a PHP formatter engine that executes user-provided code using eval(). According to the advisory, the permissions interface did not adequately communicate this capability, potentially exposing a site to arbitrary code execution when the relevant permission was granted without understanding its consequences. Version 4.2.1 addresses the issue.

Monster Menus also received a Critical advisory, rated 16 out of 25, for an object injection vulnerability involving PHP's unserialize() function. The issue arises when the RSS Page submodule processes input from a node creation form. Exploitation requires the submodule to be enabled and an attacker to hold the permission to create RSS Feed content. Administrators using affected versions should update to Monster Menus 9.5.6.

Authentication and Content Access Failures

Access-control weaknesses feature prominently in the disclosures, including an issue affecting Simple OAuth (OAuth2) & OpenID Connect. Since version 6.1.0, the module could cache one access token's permissions in a way that allowed them to be reused for another user's token with matching scopes. According to the advisory, this could grant the second user permissions they do not possess, potentially including administrative access.

The Simple OAuth vulnerability requires specific conditions. An attacker must possess an OAuth 2.0 token, while a more privileged user's token with the same scopes must have been used first. The advisory also notes that user 1 is not affected unless the security.enable_super_user setting is disabled. Versions 6.1.0 through 6.1.2 are affected, with version 6.1.3 providing the correction.

Rabbit Hole, which controls whether individual entity pages are displayed, redirected or denied, has two documented access-control failures. One allows a specific query parameter to bypass configured Rabbit Hole behaviour, potentially allowing anonymous visitors to view pages intended to return an access-denied or not-found response, or avoid a configured redirect. The second concerns inadequate field-level access restrictions on Rabbit Hole settings, which could allow users permitted to edit an entity to change those settings through alternative interfaces.

Rabbit Hole 8.x-1.3 fixes both vulnerabilities. The second issue requires an exposed write interface that bypasses the standard entity form, such as REST, JSON:API with writes enabled, or Views Bulk Operations. Sites unable to update immediately can reduce exposure by restricting relevant write operations and editing permissions, as described in the advisory.

View Unpublished has a separate access-bypass flaw involving multilingual content. When a node has both published and unpublished translations, the module could grant users with the general access-content permission to view published translations despite restrictions imposed by another node-access module. Exploitation requires a multilingual site, the relevant translation states and additional access restrictions on the published translations. Version 8.x-1.5 resolves the vulnerability.

Other access-related advisories affect Domain, Domain Login Restrict, Fullcalendar View, Media Bulk Upload and Simple User Management. Their failures involve different permission checks, including domain-specific editing rights, login restrictions, entity field updates and media creation. The Simple User Management advisory also identifies insufficient role-delegation checks and inadequate protection of user 1 from deactivation or deletion by users holding certain module permissions.

AI Tools and File Handling Introduce Additional Exposure

One advisory concerns AI File to Text, which extracts document contents for AI agents and automated workflows. The module did not sufficiently verify whether the current user could access a file before extracting its contents. This could disclose restricted documents, including files stored in Drupal's private file system, to users who otherwise lack permission to download them.

The AI File to Text vulnerability received a Moderately critical rating of 11 out of 25. Exploitation requires a user role with permission to invoke AI tools, such as through an agent or the AI API Explorer. The issue affects versions earlier than 1.0.1, which introduces the required access checks.

Information-disclosure advisories also affect ImageAPI Optimize WebP, TinyPNG and Media Alias Display. The vulnerabilities involve access checks or cache handling for files served through particular storage configurations. For example, ImageAPI Optimize WebP could mark restricted image derivatives as publicly cacheable when served from certain custom or temporary file schemes, potentially exposing previously requested files through a shared cache. The documented exposure depends on the affected file scheme, access restrictions and caching configuration.

The Ágora Transparency Theme presents another file-access issue. Its CSV preview functionality could read attached files without adequately checking download permissions, allowing visitors who could view the content page to read files they were otherwise prevented from downloading. Cached previews could also be displayed to another visitor. The issue requires restricted files stored outside the public file system, with additional download-access controls. Version 1.2.3 provides the fix for affected Drupal 11 installations.

Critical Cross-Site Scripting Issues Affect Themes and UI Icons

Four of the seven Critical advisories concern cross-site scripting vulnerabilities. Three affect the ABC, Black Hole and Zero Point themes, which insufficiently sanitised menu link titles before inserting them into HTML class attributes. Exploitation requires the ability to create or modify menu link titles through menu administration or permitted content menu settings.

UI Icons received a Critical advisory for insufficient validation of icon settings before rendering. A second, Moderately critical advisory, SA-CONTRIB-2026-230, concerns cross-site scripting in its CKEditor 5 integration. Exploitation of the second issue requires permission to edit content using a text format that enables the UI Icons CKEditor 5 button. Sites running the 1.1.x branch should update to 1.1.3, while installations using 2.0.x should update to 2.0.2. The unsupported 1.0.x branch requires migration to a supported release.

The remaining Critical advisory not covered by the code-execution and cross-site scripting categories affects Dopup. The module insufficiently checks entity access and may expose the titles of private Webforms. Additional Moderately critical cross-site scripting advisories affect Bootstrap, Block Attributes, CSV Field, Data field, Sector Distribution, Swiper Formatter and USWDS Paragraph Components, among others.

Security Releases Also Highlight Drupal 12 Compatibility Differences

The October security updates also show differences in the Drupal core versions declared by contributed projects ahead of the planned Drupal 12 release. These declarations specify supported version constraints but do not independently establish whether a project has passed comprehensive compatibility testing. Administrators planning upgrades must therefore examine the relevant branch and its dependencies alongside the published release information.

The Bootstrap theme illustrates why release branches must be distinguished. Its 8.x-3.45 security release declares compatibility with Drupal 10.5, Drupal 11.2 and Drupal 12, while the latest stable release on the separate Bootstrap 5 branch, version 5.0.2, declares support for Drupal 10.3 and Drupal 11. The project identifies its Bootstrap 3 and Bootstrap 5 implementations as distinct branches without a formal upgrade path between them. The security advisory also confirms that Bootstrap 5.0.x is not affected by the vulnerability fixed in 8.x-3.45.

Bootstrap's 8.x-3.45 release notes retain an earlier warning that three dependencies required for full functionality had not yet declared Drupal 12 compatibility. The theme itself had declared Drupal 12 compatibility in version 8.x-3.43, released on 9 October, before the latest security update. Its published constraints therefore do not establish that the 21 October release introduced Drupal 12 support.

Other security releases show different compatibility declarations. UI Icons 2.0.2 declares Drupal 12 compatibility, while Rabbit Hole 8.x-1.3 lists support through Drupal 11. View Unpublished 8.x-1.5 also retains Drupal 10 and 11 compatibility, although its maintainers have explicitly reserved Drupal 12 support and new features for the separate 2.0.x development line.

These differences do not establish that modules without a Drupal 12 declaration will fail on the new version. They show the importance of examining project-specific release constraints, supported branches and dependent packages rather than assuming that every security-fix release also expands major-version compatibility.

Administrators Urged to Review Affected Projects

The 21 October disclosures require project-specific updates rather than a single corrective action across Drupal installations. Administrators should compare their installed modules, themes and distributions against the official security advisory listing, identify affected versions and install the corresponding fixed releases. Configuration requirements and permissions should also be reviewed wherever an advisory identifies a particular exploitation condition.

The published risk assessments describe theoretical exploitation scenarios and do not, by themselves, establish that attacks have occurred against production websites. The vulnerabilities nevertheless involve sensitive functionality, including code execution, authentication, restricted content and automated document processing. Sites preparing for Drupal 12 should apply the relevant security fixes independently of their longer-term upgrade plans.