SA-CORE-2026-010: Critical severity Drupal Drupal vulnerability
The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://. This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images. Information disclosure issues like this one are not generally given security advisories (as described in PSA-2023-07-12)). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.4.4Fixed in 11.3.14Fixed in 10.6.13
Event History
Frequently Asked Questions
What is the severity of SA-CORE-2026-010?
The severity of SA-CORE-2026-010 is rated as critical with a score of 9.
How do I fix SA-CORE-2026-010?
To fix SA-CORE-2026-010, ensure that your Drupal installation is updated to the latest version that addresses this vulnerability.
What does SA-CORE-2026-010 affect?
SA-CORE-2026-010 affects the Image module in Drupal, specifically its handling of image fields and access checks.
Is SA-CORE-2026-010 exploitable?
Yes, SA-CORE-2026-010 is exploitable if Drupal is configured to allow access to image style derivatives via public file streams.
What mitigates the risk of SA-CORE-2026-010?
The risk of SA-CORE-2026-010 is mitigated if Drupal is configured to only use private file streams for serving image derivatives.