tocsin

Packagist/drupal/core CVE-2025-13082: medium 4.3, EPSS 0.24%

By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement.

Action: Upgrade drupal/core to 10.4.9 or later.

composer require drupal/core:10.4.9
composer require drupal/core:10.5.6
composer require drupal/core:11.1.9
composer require drupal/core:11.2.8

Affected

introducedfixedlast affected
8.0.010.4.9-
10.5.010.5.6-
11.0.011.1.9-
11.2.011.2.8-

Fixed versions

10.4.910.5.611.1.911.2.8

Sources

CVE-2025-13082 · published · modified · JSON