PatchClock

PHP security digest · 21 Oct 2026

TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently check access to image style derivati...

Unrated DRUPAL-CONTRIB-2026-246

Package
drupal/tinypng
Fixed in
2.0.2
Published
Wed 21 Oct 2026, 19:05 Lisbon

In plain words

TinyPNG does not sufficiently check access to image style derivatives served through a file stream other than private://, which can allow unauthorised access to those images. This requires Drupal to use a contributed (non-core) file scheme to serve private derived images.

Am I affected?

Look for drupal/tinypng and its version in composer.lock. The advisory lists 2.0.2 as fixed but gives no affected version range. Check whether Drupal is configured to serve private derived images through a contributed (non-core) file scheme rather than private://.

What to do

Check which version you have, then update to a fixed release for your branch (2.0.2):

composer show drupal/tinypng | grep versions
composer update drupal/tinypng

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The advisory describes the requirement to use a contributed (non-core) file scheme for private derived images as a mitigating factor.

The advisory's description

TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files.

The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.

This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.