CVE-2025-13083
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Drupal core has a vulnerability involving use of web browser cache containing sensitive information due to incorrectly configured access control security levels. Affects versions from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, and from 7.0 before 7.103.
Risk Assessment
Sensitive information could be exposed from a user's browser cache, potentially breaching data confidentiality. Risk applies to Drupal sites with misconfigured access control.
Recommendation
Update Drupal core to version 10.4.9, 10.5.6, 11.1.9, 11.2.8, or 7.103 (or later). Review access control configuration and cache headers.
Other vulnerabilities in Drupal core
See all- CVE-2020-13671HighActively exploited
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects Drupal Core 9.0 versions prior to 9.0.8, 8.9 prior to 8.9.9, 8.8 prior to 8.8.11, and 7 prior to 7.74.
- CVE-2026-108515Low risk· EPSS 9%
Drupal core contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Drupal core versions from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
- CVE-2026-108514Low risk· EPSS 9%
Drupal core contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Drupal core versions from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
- CVE-2026-108097Low risk· EPSS 26%
Drupal core contains an Unsafe Reflection vulnerability that uses externally-controlled input to select classes or code. This issue affects Drupal core versions from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
- CVE-2026-55805Medium
Drupal core has a Stored XSS vulnerability due to improper neutralization of input during web page generation. Affected versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and some 11.0.*, 11.1.*, 11.2.* versions.
- CVE-2026-15917Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.2.*.
- CVE-2026-15916Medium
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects versions: up to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.0.*, 11.1.*, and 11.2.*.
- CVE-2026-55808Medium
A Cross-Site Scripting (XSS) vulnerability has been discovered in Drupal Core due to improper input neutralization during web page generation. It affects a wide range of versions: from 0.0.0 to 10.5.12, 10.6.0-10.6.11, 11.2.0-11.2.14, 11.3.0-11.3.12, and all 11.0.* and 11.1.* releases.
- CVE-2026-55807Low
SSRF vulnerability in Drupal core allows an attacker to send requests from the server to internal network resources. The issue affects multiple Drupal versions including 10.5.x, 10.6.x, 11.2.x, 11.3.x, and older branches 11.0.x and 11.1.x.
- CVE-2026-55806Medium
An Open Redirect vulnerability in Drupal core allows URL redirection to untrusted sites, enabling content spoofing. This affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and older branches 11.0.* and 11.1.*.
Original NVD description (English source)
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS