CVE-2025-31675
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
CVE-2025-31675 is a medium vulnerability (CVSS 5.4) in Drupal, published February 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in drupal/core 10.1.8.
- Severity
- 5.4 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.50%EPSS, 43rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
10.1.8drupal/core +16 more
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist | 8.0.0 up to 10.1.8 | 10.1.8 |
drupal/corePackagist | 10.2.0 up to 10.2.2 | 10.2.2 |
drupal/corePackagist | 8.0.0 up to 10.3.14 | 10.3.14 |
drupal/corePackagist | 10.4.0 up to 10.4.5 | 10.4.5 |
drupal/corePackagist | 11.0.0 up to 11.0.13 | 11.0.13 |
drupal/corePackagist | 11.1.0 up to 11.1.5 | 11.1.5 |
drupalBitnami | 8.0.0 up to 10.4.5, 11.0.0 up to 11.1.5 | 10.4.511.1.5 |
drupal/coreTuxCare:Packagist From an advisory covering 10 CVEs | 9.5.11 up to 9.5.11-p1+tuxcare | 9.5.11-p1+tuxcare |
drupal/coreTuxCare:Packagist From an advisory covering 20 CVEs | 8.9.20 up to 8.9.20-p1+tuxcare | 8.9.20-p1+tuxcare |
drupal/linkTuxCare:Packagist | 7.1.13 up to 7.1.13-p1+tuxcare | 7.1.13-p1+tuxcare |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist | 8.0.0 up to 10.3.14, 10.4.0 up to 10.4.5, 11.0.0 up to 11.0.13, 11.1.0 up to 11.1.5, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.1110.2.1210.2.210.2.310.2.410.2.510.2.610.2.7 | 10.3.1410.4.511.0.1311.1.5 |
drupal/corePackagist | 8.0.0 up to 10.1.8, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.78.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.4 | 10.1.8 |
drupal/corePackagist | 10.2.0 up to 10.2.2, plus listed versions 10.2.1 | 10.2.2 |
drupal/corePackagist | 8.0.0 up to 10.3.14, plus listed versions 10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4 Show 45 moreShow less10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.1110.2.1210.2.210.2.310.2.410.2.510.2.610.2.7 | 10.3.14 |
drupal/corePackagist | 10.4.0 up to 10.4.5, plus listed versions 10.4.110.4.210.4.310.4.4 | 10.4.5 |
drupal/corePackagist | 11.0.0 up to 11.0.13, plus listed versions 11.0.111.0.1011.0.1111.0.1211.0.2 Show 7 moreShow less11.0.311.0.411.0.511.0.611.0.711.0.811.0.9 | 11.0.13 |
drupal/corePackagist | 11.1.0 up to 11.1.5, plus listed versions 11.1.111.1.211.1.311.1.4 | 11.1.5 |
What each source reports
CVE List Score used
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.
- Record
CVE-2025-31675- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-9044
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.
- Record
EUVD-2025-9044- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m4wj-hhwj-47qp
Drupal Core Cross-Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5.
- Record
GHSA-m4wj-hhwj-47qp- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6ccv-8fgf-cjpwNo score
Drupal core Denial of Service vulnerability
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
- Record
GHSA-6ccv-8fgf-cjpw- Updated
- 2026-11-02
NVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.
- Record
CVE-2025-31675- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.
- Record
CVE-2025-31675- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-m4wj-hhwj-47qp
Drupal Core Cross-Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5.
- Record
GHSA-m4wj-hhwj-47qp- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-drupal-2025-31675No score
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.
- Record
BIT-drupal-2025-31675- Updated
- 2026-11-02
OSVCLSA-2026-1776214337No score
TuxCare security update for drupal/core (11 CVEs)
TuxCare rebuilt drupal/core to address 11 CVEs. Fixed in 9.5.11-p1+tuxcare.
- Record
CLSA-2026-1776214337- Updated
- 2026-11-02
OSVCLSA-2026-1784682869No score
TuxCare security update for drupal/core (21 CVEs)
TuxCare rebuilt drupal/core to address 21 CVEs. Fixed in 8.9.20-p1+tuxcare.
- Record
CLSA-2026-1784682869- Updated
- 2026-11-02
OSVCLSA-2026-1788972447No score
TuxCare security update for drupal/link (1 CVE)
TuxCare rebuilt drupal/link to address 1 CVE. Fixed in 7.1.13-p1+tuxcare.
- Record
CLSA-2026-1788972447- Updated
- 2026-11-02
OSVDRUPAL-CORE-2025-004No score
Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability (XSS).
This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit access via core web services, or a contrib or custom module.
Sites with the Link module disabled or that do not use any link fields are not affected.
- Record
DRUPAL-CORE-2025-004- Updated
- 2026-11-02
OSVGHSA-6ccv-8fgf-cjpwNo score
Drupal core Denial of Service vulnerability
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
- Record
GHSA-6ccv-8fgf-cjpw- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
drupal.org/sa-core-2025-004
herodevs.com/vulnerability-directory/cve-2025-31675
d7es.tag1.com/security-advisories/link-moderately-critical-cross-site-scripting-sa-core-2025-004
github.com/drupal/core/commit/2f76ac716ca8019bc60579fdfc8aa6cd65d57dff
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2025-31675
git.drupalcode.org/project/drupal
Left out here: 932 versions. The JSON record has them.