PatchClock

PHP security digest · 23 Sep 2026

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML d...

Unrated CVE-2026-96382

Package
drupal/diba_carousel
Fixed in
3.0.2
Published
Wed 23 Sep 2026, 18:24 LisbonUpdated Mon 26 Oct 2026, 02:25 Lisbon

In plain words

The Diba Carousel Slider can render slide descriptions without Drupal's text format filtering or output sanitisation. This could allow an attacker to inject unsafe HTML through a slide description. Sites are affected when they use a formatted text field as the carousel description source and enable "Allow HTML description".

Am I affected?

Look for drupal/diba_carousel and its version in composer.lock. The advisory lists 3.0.2 as fixed but gives no affected version range. Check whether the carousel description source is a formatted text field and whether "Allow HTML description" is enabled. Both conditions are required for the described vulnerability.

What to do

Check which version you have, then update to a fixed release for your branch (3.0.2):

composer show drupal/diba_carousel | grep versions
composer update drupal/diba_carousel

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration.

When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. This bypasses Drupal's text format filtering and output sanitization mechanisms.

This vulnerability affects sites that use a formatted text field as the carousel description source and have enabled the "Allow HTML description" option.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.