Detections
Analytics

Drupal 11.4.x < 11.4.10 Multiple Vulnerabilities

critical Web App Scanning Plugin ID 115709

Synopsis

Drupal 11.4.x < 11.4.10 Multiple Vulnerabilities

Description

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities:

 - A vulnerability in the Drupal core Field UI module can lead to remote code execution. While not directly exploitable with core alone, multiple serious exploit paths exist with contributed modules, and at least one known exploit requires no authentication. (CVE-2026-108097)

 - The Drupal core Link module does not sufficiently sanitize certain markup in some circumstances, which can lead to a cross-site scripting (XSS) vulnerability. (CVE-2026-108515)

 - The Drupal core Navigation module does not sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. Exploitation requires a role with specific HTML entry permissions or administrative menu access. (CVE-2026-108514)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Drupal version 11.4.10 or latest.

See Also

https://www.drupal.org/project/drupal/releases/10.6.19

https://www.drupal.org/project/drupal/releases/11.3.19

https://www.drupal.org/project/drupal/releases/11.4.10

https://www.drupal.org/sa-core-2026-014

https://www.drupal.org/sa-core-2026-015

https://www.drupal.org/sa-core-2026-016

Plugin Details

Severity: Critical

ID: 115709

Type: Version Based

Published: 10/16/2026

Updated: 10/16/2026

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 98.94

CVSS v2

Risk Factor: Medium

Base Score: 5.1

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-108097

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2026-108097

Vulnerability Information

CPE: cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Exploit Ease: No known exploits are available

Patch Publication Date: 10/14/2026

Vulnerability Publication Date: 10/13/2026

Reference Information

CVE: CVE-2026-108097, CVE-2026-108514, CVE-2026-108515