PatchClock

PHP security digest · 21 Oct 2026

The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme doe...

Unrated CVE-2026-114525

Package
drupal/abc
Fixed in
1.25.0, 2.0.1
Published
Wed 21 Oct 2026, 18:38 LisbonUpdated Mon 26 Oct 2026, 07:25 Lisbon

In plain words

The ABC theme does not sufficiently sanitise menu link titles before inserting them into HTML class attributes, allowing an attacker to inject unsafe content there. The attacker must be able to create or modify menu link titles through menu administration or permitted content menu settings.

Am I affected?

Find drupal/abc and its version in composer.lock. The advisory lists 1.25.0 and 2.0.1 as fixed but gives no affected version range. Check whether your site uses the theme and who can create or modify menu link titles through menu administration or content menu settings.

What to do

Check which version you have, then update to a fixed release for your branch (1.25.0, 2.0.1):

composer show drupal/abc | grep versions
composer update drupal/abc

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The advisory says the vulnerability is mitigated by requiring the attacker to have permission to create or modify menu link titles, either through menu administration or permitted content menu settings.

The advisory's description

The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus.

The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes.

This vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles, either through menu administration or through content menu settings where permitted.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.