CVE-2022-25273

CVE-2022-25273 describes an improper input validation vulnerability in Drupal core's Form API. The flaw affects forms built by contributed or custom modules, where the API fails to properly validate certain inputs. This can allow an attacker to inject values that should be disallowed or overwrite existing data [2][3].

Exploitation requires a Drupal site running an affected version (8.0.0 to 9.2.17, or 9.3.0 to 9.3.11) and a form from a contributed or custom module that is susceptible to this validation gap. The attacker does not need special privileges if the form is publicly accessible, but the specific forms affected are uncommon [3].

The impact varies depending on the form's function. In worst-case scenarios, an attacker could alter critical or sensitive data, such as modifying user permissions or site configuration. The advisory notes that no core forms are known to be vulnerable, but custom modules may expose sensitive operations [2][3].

The Drupal Security Team released patches in versions 9.2.18 and 9.3.12. Site administrators should update immediately. The vulnerability is not covered by Drupal Steward, so proactive patching is essential. No workarounds are mentioned; updating is the recommended mitigation [3].