Update dependency drupal/core-recommended to v10 [SECURITY] - #302
Open
renovate[bot] wants to merge 1 commit into
Open
Update dependency drupal/core-recommended to v10 [SECURITY]#302renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Author
|
renovate
Bot
changed the title
renovate
Bot
deleted the
renovate/packagist-drupal-core-recommended-vulnerability
branch
August 28, 2026 12:41
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/packagist-drupal-core-recommended-vulnerability
branch
2 times, most recently
from
August 28, 2026 20:51
63cb429 to
51c75aa
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^9→^10^9→^10^8.9→^10.0Drupal Full Path Disclosure
CVE-2024-45440 / GHSA-mg8j-w93w-xjgc
More information
Details
core/authorize.phpin Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value ofhash_saltisfile_get_contentsof a file that does not exist.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Drupal core contains a potential PHP Object Injection vulnerability
CVE-2024-55638 / GHSA-gvf2-2f4g-jqf4
More information
Details
Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable.
This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to
unserialize(). There are no such known exploits in Drupal core.To help protect against this potential vulnerability, some additional checks have been added to Drupal core's database code. If you use a third-party database driver, check the release notes for additional configuration steps that may be required in certain cases.
This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.
Severity
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Drupal core contains a potential PHP Object Injection vulnerability
CVE-2024-55637 / GHSA-w6rx-9g2x-mg5g
More information
Details
Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable.
This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to
unserialize(). There are no such known exploits in Drupal core.To help protect against this potential vulnerability, types have been added to properties in some of Drupal core's classes. If an application extends those classes, the same types may need to be specified on the subclass to avoid a
TypeError.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Severity
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Drupal core contains a potential PHP Object Injection vulnerability
CVE-2024-55636 / GHSA-938f-5r4f-h65v
More information
Details
Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Artbitrary File Deletion. It is not directly exploitable.
This issue is mitigated by the fact that in order to be exploitable, a separate vulnerability must be present that allows an attacker to pass unsafe input to
unserialize(). There are no such known exploits in Drupal core.To help protect against this vulnerability, types have been added to properties in some of Drupal core's classes. If an application extends those classes, the same types may need to be specified on the subclass to avoid a
TypeError.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Severity
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Drupal core Access bypass
CVE-2024-55634 / GHSA-7cwc-fjqm-8vh8
More information
Details
Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Drupal Core Cross-Site Scripting (XSS)
CVE-2024-12393 / GHSA-8mvq-8h2v-j9vf
More information
Details
Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
drupal/core-recommended (drupal/core-recommended)
v10.2.11Compare Source
v10.2.10Compare Source
v10.2.9Compare Source
v10.2.8Compare Source
v10.2.7Compare Source
v10.2.6Compare Source
v10.2.5Compare Source
v10.2.4Compare Source
v10.2.3Compare Source
v10.2.2Compare Source
v10.2.1Compare Source
v10.2.0Compare Source
v10.1.8Compare Source
v10.1.7Compare Source
v10.1.6Compare Source
v10.1.5Compare Source
v10.1.4Compare Source
v10.1.3Compare Source
v10.1.2Compare Source
v10.1.1Compare Source
v10.1.0Compare Source
v10.0.11Compare Source
v10.0.10Compare Source
v10.0.9Compare Source
v10.0.8Compare Source
v10.0.7Compare Source
v10.0.6Compare Source
v10.0.5Compare Source
v10.0.4Compare Source
v10.0.3Compare Source
v10.0.2Compare Source
v10.0.1Compare Source
v10.0.0Compare Source
v9.5.11Compare Source
v9.5.10Compare Source
v9.5.9Compare Source
v9.5.8Compare Source
v9.5.7Compare Source
v9.5.6Compare Source
v9.5.5Compare Source
v9.5.4Compare Source
v9.5.3Compare Source
v9.5.2Compare Source
v9.5.1Compare Source
v9.5.0Compare Source
v9.4.15Compare Source
v9.4.14Compare Source
v9.4.13Compare Source
v9.4.12Compare Source
v9.4.11Compare Source
v9.4.10Compare Source
v9.4.9Compare Source
v9.4.8Compare Source
v9.4.7Compare Source
v9.4.6Compare Source
v9.4.5Compare Source
v9.4.4Compare Source
v9.4.3Compare Source
v9.4.2Compare Source
v9.4.1Compare Source
v9.4.0Compare Source
v9.3.22Compare Source
v9.3.21Compare Source
v9.3.20Compare Source
v9.3.19Compare Source
v9.3.18Compare Source
v9.3.17Compare Source
v9.3.16Compare Source
v9.3.15Compare Source
v9.3.14Compare Source
v9.3.13Compare Source
v9.3.12Compare Source
v9.3.11Compare Source
v9.3.10Compare Source
v9.3.9Compare Source
v9.3.8Compare Source
v9.3.7Compare Source
v9.3.6Compare Source
v9.3.5Compare Source
v9.3.4Compare Source
v9.3.3Compare Source
v9.3.2Compare Source
v9.3.1Compare Source
v9.3.0Compare Source
v9.2.21Compare Source
v9.2.20Compare Source
v9.2.19Compare Source
v9.2.18Compare Source
v9.2.17Compare Source
v9.2.16Compare Source
v9.2.15Compare Source
v9.2.14Compare Source
v9.2.13Compare Source
v9.2.12Compare Source
v9.2.11Compare Source
v9.2.10Compare Source
v9.2.9Compare Source
v9.2.8Compare Source
v9.2.7Compare Source
v9.2.6Compare Source
v9.2.5Compare Source
v9.2.4Compare Source
v9.2.3Compare Source
v9.2.2Compare Source
v9.2.1Compare Source
v9.2.0Compare Source
v9.1.15Compare Source
v9.1.14Compare Source
v9.1.13Compare Source
v9.1.12Compare Source
v9.1.11Compare Source
v9.1.10Compare Source
v9.1.9Compare Source
v9.1.8Compare Source
v9.1.7Compare Source
v9.1.6Compare Source
v9.1.5Compare Source
v9.1.4Compare Source
v9.1.3Compare Source
v9.1.2Compare Source
v9.1.1Compare Source
v9.1.0Compare Source
v9.0.14Compare Source
v9.0.13Compare Source
v9.0.12Compare Source
v9.0.11Compare Source
v9.0.10Compare Source
v9.0.9Compare Source
v9.0.8Compare Source
v9.0.7Compare Source
v9.0.6Compare Source
v9.0.5Compare Source
v9.0.4Compare Source
v9.0.3Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.