Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Drupal core Link module XSS CVE-2026-108515 is moderately critical; 11.4.x should update to 11.4.10.
Drupal advisory SA-CORE-2026-015 discloses CVE-2026-108515, a moderately critical cross-site scripting issue in the Drupal core Link module. The URL field type does not sufficiently sanitize certain markup in some circumstances. Drupal rates the risk 13/25, with basic complexity, user privileges, some confidentiality and integrity impact, proof-level exploit maturity, and uncommon distribution. Affected versions start at 8.9.0 and include 11.0, 11.4, and 12.0.0-alpha1 before 12.0.0-beta2; Drupal 11.4.x users should update to 11.4.10.
- Link module can fail to sanitize certain URL-field markup.
- Drupal rates risk 13/25 and marks exploit maturity as proof.
- Affected lines run from Drupal 8.9 through current 11 and 12 prereleases.
- Drupal 11.4 users should update to 11.4.10.
- CVEs
- CVE-2026-108515
- Vendors
- Drupal
- Products
- Drupal coreLink
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108515 | — | — | — |
From the original article
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 8. 9. 0 = 11.
By Drupal Security Team · drupal.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.