Packagist/drupal/core CVE-2025-31673: unknown, EPSS 0.31%

Bulk operations allow authorized users to modify several nodes at once from the Content page (`/admin/content`). A site builder can also add bulk operations to other pages using Views.

Action: Upgrade drupal/core to 10.3.13 or later.

composer require drupal/core:10.3.13

composer require drupal/core:10.4.3

composer require drupal/core:11.0.12

composer require drupal/core:11.1.3

Affected

introduced	fixed	last affected
8.0.0	10.3.13	-
10.4.0	10.4.3	-
11.0.0	11.0.12	-
11.1.0	11.1.3	-

Fixed versions

10.3.13

10.4.3

11.0.12

11.1.3

Sources

osv: DRUPAL-CORE-2025-002
https://www.drupal.org/sa-core-2025-002

CVE-2025-31673 · published 2025-02-19T16:58:10Z · modified 2026-09-19T14:48:16Z · JSON