CVE-2022-25271
Drupal core Denial of Service vulnerability
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Record
CVE-2022-25271- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Record
CVE-2022-25271- Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2022-0984 No score
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Record
EUVD-2022-0984- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fmfv-x8mp-5767
Improper input validation in Drupal core
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Record
GHSA-fmfv-x8mp-5767- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6ccv-8fgf-cjpw No score
Drupal core Denial of Service vulnerability
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
- Record
GHSA-6ccv-8fgf-cjpw- Updated
- 2026-11-02
OSVALPINE-CVE-2022-25271
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Record
ALPINE-CVE-2022-25271- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
Show 7 moreShow less
OSVGHSA-fmfv-x8mp-5767
Improper input validation in Drupal core
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Record
GHSA-fmfv-x8mp-5767- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-25271
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Record
UBUNTU-CVE-2022-25271- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVBIT-drupal-2022-25271 No score
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Record
BIT-drupal-2022-25271- Updated
- 2026-11-02
OSVCLSA-2026-1784682869 No score
TuxCare security update for drupal/core (21 CVEs)
TuxCare rebuilt drupal/core to address 21 CVEs. Fixed in 8.9.20-p1+tuxcare.
- Record
CLSA-2026-1784682869- Updated
- 2026-11-02
OSV No score
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Record
CVE-2022-25271- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDRUPAL-CORE-2022-003 No score
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
This advisory is not covered by Drupal Steward.
- Record
DRUPAL-CORE-2022-003- Updated
- 2026-11-02
OSVGHSA-6ccv-8fgf-cjpw No score
Drupal core Denial of Service vulnerability
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
- Record
GHSA-6ccv-8fgf-cjpw- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist |
8.0.0 up to 10.1.8 | 10.1.8 |
drupal/corePackagist |
10.2.0 up to 10.2.2 | 10.2.2 |
drupal/corePackagist |
9.3.0 up to 9.3.6 | 9.3.6 |
drupal/corePackagist |
8.0.0 up to 9.2.13 | 9.2.13 |
drupal/corePackagist |
7.0.0 up to 7.88 | 7.88 |
drupal7Alpine:v3.15 |
before 7.89-r0 | 7.89-r0 |
drupal7Alpine:v3.16 |
before 7.89-r0 | 7.89-r0 |
drupal7Alpine:v3.17 |
before 7.89-r0 | 7.89-r0 |
drupal7Alpine:v3.18 |
before 7.89-r0 | 7.89-r0 |
drupal7Alpine:v3.19 |
before 7.89-r0 | 7.89-r0 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
drupal7Alpine:v3.20 |
before 7.89-r0 | 7.89-r0 |
drupalBitnami |
7.0.0 up to 7.88.0, 9.2.0 up to 9.2.13, 9.3.0 up to 9.3.6 | 7.88.09.2.139.3.6 |
drupal/coreTuxCare:Packagist From an advisory covering 20 CVEs |
8.9.20 up to 8.9.20-p1+tuxcare | 8.9.20-p1+tuxcare |
drupal7Debian:9 |
before 7.52-2+deb9u18, plus listed versions 7.52-27.52-2+deb9u17.52-2+deb9u107.52-2+deb9u117.52-2+deb9u12 Show 13 moreShow less7.52-2+deb9u137.52-2+deb9u147.52-2+deb9u157.52-2+deb9u167.52-2+deb9u177.52-2+deb9u27.52-2+deb9u37.52-2+deb9u47.52-2+deb9u57.52-2+deb9u67.52-2+deb9u77.52-2+deb9u87.52-2+deb9u9 |
7.52-2+deb9u18 |
drupal/corePackagist |
8.0.0 up to 9.2.13, 9.3.0 up to 9.3.6, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 |
9.2.139.3.6 |
drupal/corePackagist |
8.0.0 up to 10.1.8, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.78.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.4 |
10.1.8 |
drupal/corePackagist |
10.2.0 up to 10.2.2, plus listed versions 10.2.1 |
10.2.2 |
drupal/corePackagist |
9.3.0 up to 9.3.6, plus listed versions 9.3.19.3.29.3.39.3.49.3.5 |
9.3.6 |
drupal/corePackagist |
8.0.0 up to 9.2.13, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 |
9.2.13 |
drupal7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3 |
None known |
drupal7Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-25271 is a high vulnerability (CVSS 7.5) in Drupal Core, published February 16, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 70th percentile. Fixed in drupal/core 10.1.8.
References
drupal.org/sa-core-2022-003
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3
github.com/drupal/core/commit/2f76ac716ca8019bc60579fdfc8aa6cd65d57dff
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2022-25271
security.alpinelinux.org/vuln/CVE-2022-25271
ubuntu.com/security/CVE-2022-25271
cve.org/CVERecord?id=CVE-2022-25271
Left out here: 635 versions. The JSON record has them.