Vulnerability advisory

CVE-2025-31675

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Published Mar 31, 2025Updated Oct 28, 2026OSV record ↗

Also known as BIT-drupal-2025-31675DRUPAL-CORE-2025-004GHSA-m4wj-hhwj-47qp

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT git.drupalcode.org/project/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before 2c5ca7aca6286a0cb14d26c046490f6db19c591a	`2c5ca7aca6286a0cb14d26c046490f6db19c591a`
efaa2a46341068974ec6927416ac58f1bed84cbb to before 18ab15707b4dc70a63b5758f64f11b9edbf61f78	`18ab15707b4dc70a63b5758f64f11b9edbf61f78`
140f94ff1051644c4416c7ed30cc5dd1f14507b2 to before 59b775ad8bc01baa7fc232454c0529eb0cb6f682	`59b775ad8bc01baa7fc232454c0529eb0cb6f682`
09d3d7fd4a638e3cc53eff60922765ad3af19c66 to before f286521ced6bdf91c92e9ff533c24021e8fc02f9	`f286521ced6bdf91c92e9ff533c24021e8fc02f9`
GIT git.drupalcode.org/project/link ↗
2b160048c1fe2e04e86c9c394c56396e97641321 through 688d36a3c1b919936c167d05c65e8a1f1acac03f	No fix listed
GIT github.com/drupal/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before 2c5ca7aca6286a0cb14d26c046490f6db19c591a	`2c5ca7aca6286a0cb14d26c046490f6db19c591a`
efaa2a46341068974ec6927416ac58f1bed84cbb to before 18ab15707b4dc70a63b5758f64f11b9edbf61f78	`18ab15707b4dc70a63b5758f64f11b9edbf61f78`
140f94ff1051644c4416c7ed30cc5dd1f14507b2 to before 59b775ad8bc01baa7fc232454c0529eb0cb6f682	`59b775ad8bc01baa7fc232454c0529eb0cb6f682`
09d3d7fd4a638e3cc53eff60922765ad3af19c66 to before f286521ced6bdf91c92e9ff533c24021e8fc02f9	`f286521ced6bdf91c92e9ff533c24021e8fc02f9`
Also listed as affected (57) `10.3.13` `10.4.4` `11.0.12` `11.1.4` `10.3.12` `10.4.2` `11.0.11` `11.1.2` `10.3.11` `10.4.1` `11.0.10` `11.1.1` `10.4.0` `11.1.0` `10.3.10` `11.0.9` `10.3.8` `11.0.7` `10.3.7` `11.0.6` `10.3.6` `11.0.5` `10.3.5` `11.0.4` `10.3.4` `11.0.3` `10.3.3` `11.0.2` `10.3.2` `11.0.1` `11.0.0` `10.3.1` `10.3.0-rc1` `10.3.0-beta1` `10.1.0-alpha1` `10.0.0-alpha5` `10.0.0-alpha4` `10.0.0-alpha3` `10.0.0-alpha1` `9.0.0-alpha2` `9.0.0-alpha1` `8.1.0-beta1` `8.0.0` `7.x-1.12` `7.x-1.11` `7.x-1.10` `7.x-1.9` `7.x-1.8` `7.x-1.7` `7.x-1.5-beta3` `7.x-1.5-beta2` `7.x-1.5-beta1` `7.x-1.4` `7.x-1.3` `7.x-1.2` `7.x-1.1` `7.x-1.0`

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.

CVE-2025-31675

Affected versions

Repository

Description

References