Drupal : vulnérabilité

1. Vérifier si vous êtes concerné

   Comparer la version installée aux versions corrigées ci-dessous.

   drush status --field=drupal-version
   composer show drupal/core

2. Corriger

   Versions corrigées : voir l'avis de l'éditeur (lien dans les sources).

   Mettre à jour le cœur ou le module concerné avec Composer, appliquer les mises à jour de base, vider les caches, sur chaque site.

   composer update "drupal/core-*" --with-all-dependencies
   composer update drupal/<module> --with-all-dependencies
   drush updatedb -y && drush cache:rebuild

3. En attendant le correctif

   Désactiver le module concerné (drush pm:uninstall <module>) si le correctif ne peut pas passer tout de suite, ou retirer la permission vulnérable aux rôles non administrateurs.

4. Contrôler

   drush status --field=drupal-version et composer show drupal/<module> doivent afficher la version corrigée.

   Rapport de statut Drupal (/admin/reports/status) sans alerte de sécurité.

Commandes indicatives (Debian ou Ubuntu) : à adapter à chaque serveur, après sauvegarde.

There will be a Drupal core security release for all supported branches on October 14, 2026 between 16:00 and 21:00 UTC . (To see this in your local timezone, refer to the Drupal Core Calendar .) Based on our analysis this vulnerability rates at 19/25 on our risk calculator. The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days. We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14 , so that you can address any other upgrade issues before the security window. This issue is being protected by Drupal Steward . Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered. Affected versions All currently supported versions of Drupal core are affected, including: - Drupal 11.4.x - Drupal 11.3.x - Drupal 10.6.x Drupal 12.0.0-beta1 is also affected. New beta releases will be provided following the security updates for the supported branches. All versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported. Sites on those versions should update as soon as possible to avoid this and other publicly disclosed vulnerabilities. Disclosure policy Neither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made. Security release announcements will appear on the Drupal.org security advisory page , which has RSS feeds. The announcement will also be made public on: - The #security-team channel of the Drupal community Slack - Bluesky - Mastodon - X (formerly Twitter) - LinkedIn - By email for those who have subscribed to our email list. (To subscribe to the email list: log in on Drupal.org, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab.)