Skip to main content

Drupal SA-CONTRIB-2026-011 through 019: Full Triage Map and Impact Assessment

· 4 min read
Victor Jimenez
Victor Jimenez
Software Engineer & AI Agent Builder

I reviewed Drupal advisories SA-CONTRIB-2026-011 through SA-CONTRIB-2026-019 (published on 2026-02-25) and mapped them against active drupal-* projects. Nine advisories, nine modules, one triage session.

Nine Advisories in One Day

Drupal published nine contrib security advisories on a single day. Even if none of these modules are in your current stack, add them to your dependency watchlist so you catch them if they show up later.

Advisory-to-Module Map​

SA IDModuleCVEFix VersionVulnerability Type
SA-CONTRIB-2026-011drupal/material_iconsCVE-2026-32102.0.4Access bypass
SA-CONTRIB-2026-012drupal/theme_ruleCVE-2026-32111.2.1CSRF
SA-CONTRIB-2026-013drupal/tagify--1.2.49--
SA-CONTRIB-2026-014drupal/cleantalk--9.7.0--
SA-CONTRIB-2026-015drupal/captchaCVE-2026-32148.x-1.17 / 2.0.10Access bypass
SA-CONTRIB-2026-016drupal/islandoraCVE-2026-32152.17.5File upload + XSS
SA-CONTRIB-2026-017drupal/canvasCVE-2026-32161.1.1SSRF + info disclosure
SA-CONTRIB-2026-018drupal/miniorange_samlCVE-2026-32173.1.3Reflected XSS
SA-CONTRIB-2026-019drupal/responsive_faviconsCVE-2026-32182.0.2Persistent XSS

Current Project Impact​

I scanned across drupal-* repositories in my active projects directory.

Fast Dependency Check

Run composer show --locked | grep -E "material_icons|theme_rule|tagify|cleantalk|captcha|islandora|canvas|miniorange_saml|responsive_favicons" against every composer.lock in your project portfolio.

Results:

  • composer.json direct requirements: no matches for affected packages
  • composer.lock installed package names: no matches for affected packages
  • Code-level references: one non-dependency mention of tagify API usage in drupal-ai-context-issue-3572160, but no drupal/tagify package requirement found

"No currently affected active project dependencies detected for this advisory set."

Upgrade and Mitigation Actions​

Even with zero current matches, I set up forward-looking controls.

If No Affected Modules Are Installed​

  • Add these package names to dependency watchlists in CI checks
  • Re-run advisory triage whenever any of these modules are introduced
  • Document baseline clean status for audit trail

If Any Affected Module Is Added Later​

  • Pin minimum safe versions immediately in composer.json
  • Run composer update drupal/<module> --with-all-dependencies
  • Verify role/permission hardening notes from each advisory before deploy
  • Clear caches and rebuild router: drush cr
  • Test critical paths after update
Terminal — batch check all affected packages
composer show --locked | grep -E "material_icons|theme_rule|tagify|cleantalk|captcha|islandora|canvas|miniorange_saml|responsive_favicons"
Terminal — example: pin safe version for captcha
composer require drupal/captcha:^2.0.10
drush cr
Special note: SA-CONTRIB-2026-017 (Drupal Canvas)

If Canvas is adopted later, verify the hidden submodule canvas_ai state and related permissions as part of release QA. Recipe-driven enablement can introduce canvas_ai without explicit awareness.

Check with:

drush config:get core.extension | grep canvas_ai

If canvas_ai is enabled and users have the use Drupal Canvas AI permission, the SSRF and information disclosure vectors from SA-CONTRIB-2026-017 apply.

Individual Advisory Reviews​

For deep-dive analysis on each advisory, see the dedicated review posts:

References​