Vulnerability advisory

CVE-2022-25271

Published Feb 16, 2022Updated Oct 28, 2026OSV record ↗

Also known as BIT-drupal-2022-25271DRUPAL-CORE-2022-003GHSA-fmfv-x8mp-5767

Severity

Severity not reported.

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
All commits before 619a1f0e33d7dc694840d01374bd2d1660eabb8d	`619a1f0e33d7dc694840d01374bd2d1660eabb8d`
943ecef3c0bc9822338252a7df6419aeb9253c9d to before 7c620f0d179eee168b27509f3902f99e9fa52703	`7c620f0d179eee168b27509f3902f99e9fa52703`
698ee686c23de8c97d7e0601cf745b220d54f4e1 to before e205f31c36c6db950f50d473cfd24ad22ac98ae1	`e205f31c36c6db950f50d473cfd24ad22ac98ae1`
Also listed as affected (89) `7.87` `9.2.12` `9.3.5` `9.2.11` `9.3.4` `7.85` `9.2.10` `9.3.2` `7.84` `9.3.0` `7.83` `9.2.8` `9.2.7` `9.2.5` `9.2.3` `7.81` `9.2.1` `9.2.0` `7.79` `7.77` `7.76` `7.71` `7.68` `7.64` `7.61` `7.56` `7.55` `7.54` `7.51` `7.50` `7.43` `7.42` `7.40` `7.37` `7.36` `7.33` `7.30` `7.28` `7.25` `7.23` `7.22` `7.17` `7.15` `7.14` `7.12` `7.10` `7.9` `7.8` `7.7` `7.6` `7.4` `7.0` `7.0-rc-4` `7.0-rc-3` `7.0-rc-2` `7.0-rc-1` `7.0-beta3` `7.0-beta2` `7.0-beta1` `7.0-alpha7` `7.0-alpha6` `7.0-alpha5` `7.0-alpha4` `7.0-alpha3` `7.0-alpha2` `7.0-alpha1` `7.0-unstable-10` `7.0-unstable-7` `7.0-unstable-6` `7.0-unstable-5` `7.0-unstable-4` `7.0-unstable-3` `7.0-unstable-2` `7.0-unstable-1` `6.0-rc-3` `6.0-rc-2` `6.0-rc-1` `6.0-beta-4` `6.0-beta-3` `6.0-beta-2` `6.0-beta-1` `5.0-rc-2` `5.0-rc-1` `5.0-beta-2` `5.0-beta-1` `3.0.1` `2.0` `1.0` `start`

Description

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

CVE-2022-25271

Affected versions

Repository

Description

References