PatchClock

PHP security digest · 16 Sep 2026

The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. CKEditor has released [a security update that impacts...

Unrated DRUPAL-CORE-2026-013

Package
drupal/core
Fixed in
10.6.17, 11.3.17, 11.4.7
Published
Wed 16 Sep 2026, 17:21 LisbonUpdated Mon 26 Oct 2026, 00:28 Lisbon
Installs on Packagist
71M

In plain words

If Drupal is configured to use CKEditor for WYSIWYG editing, an attacker who can create or edit content may be able to run malicious scripts against users with access to that editor, including privileged site admins. The attacker does not need access to CKEditor themselves.

Am I affected?

Find drupal/core and its version in composer.lock, then check whether Drupal is configured to use CKEditor for WYSIWYG editing. The advisory lists fixes in 10.6.17, 11.3.17 and 11.4.7, but gives no affected version ranges. The attack requires someone able to create or edit content and targets users with access to CKEditor.

What to do

Check which version you have, then update to a fixed release for your branch (10.6.17, 11.3.17, 11.4.7):

composer show drupal/core | grep versions
composer update drupal/core

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.

Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit this Cross-Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

For more information, see CKEditor's security advisory:

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.