Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

Root

Cause

CVE-2025-13082 is a UI misrepresentation vulnerability in Drupal core that enables content spoofing. The flaw stems from insufficient input validation when processing certain URL parameters, allowing an attacker to inject arbitrary content into a page rendered by the Drupal application.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL and tricking a logged-in user (or any user with access to the affected page) into visiting it. No authentication is required to trigger the defacement, but the interaction of the victim is necessary. The content spoofing is transient and only appears when the specially crafted URL is used; normal site content and branding are not manipulated.

Impact

A successful attack results in temporary defacement of the Drupal site. The attacker can present misleading or unauthorized content to the victim, potentially harming the site's reputation or misleading users. The defacement is not persistent and does not alter stored data or compromise administrative control.

Mitigation

The Drupal project has released security fixes. Affected users should update to Drupal 10.4.9, 10.5.6, 11.1.9, or 11.2.8 depending on their minor version. Older branches (Drupal 11.0.x, 10.3.x, and below) are end-of-life and no longer receive security updates [3].