PatchClock

PHP security digest · 14 Oct 2026

The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in...

Unrated CVE-2026-108515

Package
drupal/core
Fixed in
10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2
Published
Wed 14 Oct 2026, 18:25 LisbonUpdated Mon 26 Oct 2026, 05:25 Lisbon
Installs on Packagist
71M

In plain words

Drupal core's Link module does not sufficiently sanitise certain markup in some circumstances. This can allow cross-site scripting (XSS) through the module, which provides fields for internal and external URLs.

Am I affected?

Find drupal/core and its version in composer.lock, then check whether your project uses the core Link module's URL fields. The advisory does not provide affected version ranges or explain the specific circumstances that trigger the flaw. It lists 10.6.19, 11.3.19, 11.4.10 and 12.0.0-beta2 as fixed versions.

What to do

Check which version you have, then update to a fixed release for your branch (10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2):

composer show drupal/core | grep versions
composer update drupal/core

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The Drupal core Link module provides a field type that can be used for internal and external URLs.

The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.