Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Drupal Security Team has published a new security advisory. Here is a summary and what to do.
Key points
- New advisory from Drupal Security Team.
- Review affected versions in the advisory.
- Apply updates promptly.
Drupal Security Team published a security advisory titled “Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015”.
At a glance
- Publisher
- Drupal Security Team
- CVEs
- CVE-2026-108515
What the advisory says
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108515 Description: The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities. Solution: Install the latest version: Drupal 11 If you use Drupal 11.4.x, update to Drupal 11.4.10 . If you use Drupal 11.3.x, update to Drupal 11.3.19 . Drupal 11.2.x and below are end-of-life and do not receive security coverage. Drupal 10 If you use Drupal 10.6.x, update to Drupal 10.6.19 . Drup
What should you do?
- Read the full vendor advisory linked below and confirm whether you run affected versions.
- Schedule the recommended update, prioritising internet-facing systems.
- Watch for exploitation reports; unpatched edge devices are frequent targets.
What to do and how to stay safe: CVE-2026-108515
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
