Project:
Vulnerability:
Information disclosure
Affected versions:
<10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*
CVE IDs:
CVE-2026-15916
Description:
The Image module allows you to define and configure image fields.
The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.
This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.
Information disclosure issues like this one are not generally given security advisories (as described in .
have both reached end-of-life.
Reported By:
- of the Drupal Security Team
Coordinated By:
- of the Drupal Security Team
- of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Vollständiger Original-Bericht
Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf drupal.org.
SOCIAL SHARE CARD GENERATOR