Просмотр новости
Найдите то, что Вас интересует
Спутники
РН
SpaceX
Роскосмос
NASA
СпутникиРНSpaceXРоскосмосNASAProject: Drupal coreDate: 2026-July-15Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*CVE IDs: CVE-2026-15916Description: The Image module allows you to define and configure image fields.
The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.
This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.
Information disclosure issues like this one are not generally given security advisories (as described in PSA-2023-07-12)). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.Solution: Install the latest version:
Drupal 11
If you use Drupal 11.4.x, update to Drupal 11.4.4.
If you use Drupal 11.3.x, update to Drupal 11.3.14.
Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
If you use Drupal 10.6.x, update to Drupal 10.6.13.
Drupal 10.5.x and below are end-of-life and do not receive security coverage.
Drupal 8 and Drupal 9 have both reached end-of-life.Reported By:
offensive-ai
Fixed By:
Benji Fisher (benjifisher) of the Drupal Security Team
Kim Pepper (kim.pepper)
Mohit Aghera (mohit_aghera)
Coordinated By:
Benji Fisher (benjifisher) of the Drupal Security Team
catch (catch) of the Drupal Security Team
Lee Rowlands (larowlan) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team
| # | Наименование новости | Тональность | Информативность | Дата публикации |
|---|---|---|---|---|
| 1 | Security advisories: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012 | 0 | 5 | 15-07-2026 |
| 2 | Security advisories: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011 | 0 | 7 | 15-07-2026 |
| 3 | After revolution slider update - not working on different languages | 0 | 7 | 13-07-2026 |
| 4 | All That Jazz (1979) dir. Bob Fosse | 0 | 1 | 03-07-2026 |
| 5 | Drupal.org blog: Migrating issues from security.drupal.org to git.drupalcode.org | 5 | 7 | 17-07-2026 |
| 6 | F-104 Starfighter and SR-71 Blackbird. First image colorized by @grok. The original is obviously… | 0 | 3 | 01-07-2026 |
| 7 | Webpro Company blog: Drupal core July security updates: what site owners should check now | 0 | 7 | 16-07-2026 |
| 8 | DDEV Blog: DDEV July 2026: New Screencasts, Partner Perks | 5 | 7 | 16-07-2026 |
| 9 | The AI Hype Reckoning Is Upon Us | -3 | 6 | 09-07-2026 |
| 10 | Matt Glaman: phpstan-drupal 2.1.0: stricter defaults | 0 | 7 | 14-07-2026 |