DRUPAL-CORE-2026-010

At a glance

Published: 2026-07-15 19:50 UTC
Updated: 2026-07-15 20:56 UTC
CVE: CVE-2026-15916

Description

The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than `private://`. This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images. Information disclosure issues like this one are not generally given security advisories (as described in [PSA-2023-07-12)](https://www.drupal.org/psa-2023-07-12)). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.

Affected packages

Package	Versions
Packagist · drupal/core	introduced 0, fixed 10.6.13 ; introduced 11.3.0, fixed 11.3.14 ; introduced 11.4.0, fixed 11.4.4 ; introduced 11.0.0, fixed 11.1.0 ; introduced 11.1.0, fixed 11.2.0 ; introduced 11.2.0, fixed 11.3.0

References

https://www.drupal.org/sa-core-2026-010 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence