VYPR
← All advisories
High severity7.5NVD Advisory· Published Feb 16, 2022· Updated Jun 17, 2026

CVE-2022-25271

CVE-2022-25271

Description

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
drupal/corePackagist
>= 9.3.0, < 9.3.69.3.6
drupal/corePackagist
>= 8.0.0, < 9.2.139.2.13
drupal/corePackagist
>= 7.0.0, < 7.887.88

Affected products

6
  • Drupal/Drupal
    cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
    Range: >=7.0.0,<7.88
  • Fedoraproject/Fedora2 versions
    cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
  • osv-coords2 versions
    pkg:bitnami/drupalpkg:composer/drupal/core
    >= 7.0.0, < 7.88.0+ 1 more
    • (no CPE)range: >= 7.0.0, < 7.88.0
    • (no CPE)range: >= 9.3.0, < 9.3.6
  • Drupal/Corev5
    Range: 9.3.x

Patches

Vulnerability mechanics

References

9

News mentions

0

No linked articles in our index yet.