CVE-2025-13080
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
An improper check for unusual or exceptional conditions vulnerability in Drupal core allows forceful browsing. The issue affects Drupal core from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, and from 11.2.0 before 11.2.8.
Risk Assessment
An attacker may access resources or functions that should not be directly reachable, potentially leading to information disclosure or unauthorized actions.
Recommendation
Update Drupal core to version 10.4.9, 10.5.6, 11.1.9, or 11.2.8 (or later). Review access permissions for sensitive paths and functions.
Other vulnerabilities in Drupal core
See all- CVE-2020-13671HighActively exploited
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects Drupal Core 9.0 versions prior to 9.0.8, 8.9 prior to 8.9.9, 8.8 prior to 8.8.11, and 7 prior to 7.74.
- CVE-2026-108515Low risk· EPSS 9%
Drupal core contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Drupal core versions from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
- CVE-2026-108514Low risk· EPSS 9%
Drupal core contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Drupal core versions from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
- CVE-2026-108097Low risk· EPSS 26%
Drupal core contains an Unsafe Reflection vulnerability that uses externally-controlled input to select classes or code. This issue affects Drupal core versions from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
- CVE-2026-55805Medium
Drupal core has a Stored XSS vulnerability due to improper neutralization of input during web page generation. Affected versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and some 11.0.*, 11.1.*, 11.2.* versions.
- CVE-2026-15917Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.2.*.
- CVE-2026-15916Medium
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects versions: up to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.0.*, 11.1.*, and 11.2.*.
- CVE-2026-55808Medium
A Cross-Site Scripting (XSS) vulnerability has been discovered in Drupal Core due to improper input neutralization during web page generation. It affects a wide range of versions: from 0.0.0 to 10.5.12, 10.6.0-10.6.11, 11.2.0-11.2.14, 11.3.0-11.3.12, and all 11.0.* and 11.1.* releases.
- CVE-2026-55807Low
SSRF vulnerability in Drupal core allows an attacker to send requests from the server to internal network resources. The issue affects multiple Drupal versions including 10.5.x, 10.6.x, 11.2.x, 11.3.x, and older branches 11.0.x and 11.1.x.
- CVE-2026-55806Medium
An Open Redirect vulnerability in Drupal core allows URL redirection to untrusted sites, enabling content spoofing. This affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and older branches 11.0.* and 11.1.*.
Original NVD description (English source)
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS