Critical Vulnerabilities found in Drupal Core
Project: Drupal core
Security risk: Critical 18∕25 AC:Basic/A:Admin/CI:All/II:All/E:Proof/TD:All
Vulnerability: Multiple vulnerabilities
Affected versions: >= 8.0.0 <9.3.22 || >= 9.4.0 <9.4.7
CVE IDs: CVE-2022-39261
Description: Drupal uses the Twig third-party library for content templating and sanitization. Twig has released a security update that affects Drupal. Twig has rated the vulnerability as high severity.
Drupal core's code extending Twig has also been updated to mitigate a related vulnerability.
Multiple vulnerabilities are possible if an untrusted user has access to write Twig code, including potential unauthorized read access to private files, the contents of other files on the server, or database credentials.
The vulnerability is mitigated by the fact that an exploit is only possible in Drupal core with a restricted access administrative permission. Additional exploit paths for the same vulnerability may exist with contributed or custom code that allows users to write Twig templates.
Solution: Install the latest version:
- If you are using Drupal 9.4, update to Drupal 9.4.7.
- If you are using Drupal 9.3, update to Drupal 9.3.22.
All versions of Drupal 9 prior to 9.3.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life.
Drupal 7 core does not include Twig and therefore is not affected.
- xjm of the Drupal Security Team
- Alex Pott of the Drupal Security Team
- Sascha Grossenbacher
- Lee Rowlands of the Drupal Security Team
- Lauri Eskola, provisional member of the Drupal Security Team
- Nathaniel Catchpole of the Drupal Security Team
- Dave Long, provisional member of the Drupal Security Team
- cilefen of the Drupal Security Team
- James Williams
- Benji Fisher, provisional member of the Drupal Security Team
Note: The vision of this web portal is to help promote news and stories around the Drupal community and promote and celebrate the people and organizations in the community. We strive to create and distribute our content based on these content policy. If you see any omission/variation on this please let us know in the comments below and we will try to address the issue as best we can.