Skip to main content

Drupal SA-CONTRIB-2026-011 through 019: Full Triage Map and Impact Assessment

· 5 min read
Victor Jimenez
Victor Jimenez
Software Engineer & AI Agent Builder

I reviewed Drupal advisories SA-CONTRIB-2026-011 through SA-CONTRIB-2026-019 (published on 2026-02-25) and mapped them against active drupal-* projects. Nine advisories, nine modules, one triage session.

Nine Advisories in One Day

Drupal published nine contrib security advisories on a single day. Even if none of these modules are in your current stack, add them to your dependency watchlist so you catch them if they show up later.

Advisory-to-Module Map​

SA IDModuleCVEFix VersionVulnerability Type
SA-CONTRIB-2026-011drupal/material_iconsCVE-2026-32102.0.4Access bypass
SA-CONTRIB-2026-012drupal/theme_ruleCVE-2026-32111.2.1CSRF
SA-CONTRIB-2026-013drupal/tagify--1.2.49--
SA-CONTRIB-2026-014drupal/cleantalk--9.7.0--
SA-CONTRIB-2026-015drupal/captchaCVE-2026-32148.x-1.17 / 2.0.10Access bypass
SA-CONTRIB-2026-016drupal/islandoraCVE-2026-32152.17.5File upload + XSS
SA-CONTRIB-2026-017drupal/canvasCVE-2026-32161.1.1SSRF + info disclosure
SA-CONTRIB-2026-018drupal/miniorange_samlCVE-2026-32173.1.3Reflected XSS
SA-CONTRIB-2026-019drupal/responsive_faviconsCVE-2026-32182.0.2Persistent XSS

Current Project Impact​

I scanned across drupal-* repositories in my active projects directory.

Fast Dependency Check

Run composer show --locked | grep -E "material_icons|theme_rule|tagify|cleantalk|captcha|islandora|canvas|miniorange_saml|responsive_favicons" against every composer.lock in your project portfolio.

Results:

  • composer.json direct requirements: no matches for affected packages
  • composer.lock installed package names: no matches for affected packages
  • Code-level references: one non-dependency mention of tagify API usage in drupal-ai-context-issue-3572160, but no drupal/tagify package requirement found

"No currently affected active project dependencies detected for this advisory set."

Upgrade and Mitigation Actions​

Even with zero current matches, I set up forward-looking controls.

If No Affected Modules Are Installed​

  • Add these package names to dependency watchlists in CI checks
  • Re-run advisory triage whenever any of these modules are introduced
  • Document baseline clean status for audit trail

If Any Affected Module Is Added Later​

  • Pin minimum safe versions immediately in composer.json
  • Run composer update drupal/<module> --with-all-dependencies
  • Verify role/permission hardening notes from each advisory before deploy
  • Clear caches and rebuild router: drush cr
  • Test critical paths after update
Terminal — batch check all affected packages
composer show --locked | grep -E "material_icons|theme_rule|tagify|cleantalk|captcha|islandora|canvas|miniorange_saml|responsive_favicons"
Terminal — example: pin safe version for captcha
composer require drupal/captcha:^2.0.10
drush cr
Special note: SA-CONTRIB-2026-017 (Drupal Canvas)

If Canvas is adopted later, verify the hidden submodule canvas_ai state and related permissions as part of release QA. Recipe-driven enablement can introduce canvas_ai without explicit awareness.

Check with:

drush config:get core.extension | grep canvas_ai

If canvas_ai is enabled and users have the use Drupal Canvas AI permission, the SSRF and information disclosure vectors from SA-CONTRIB-2026-017 apply.

Individual Advisory Reviews​

For deep-dive analysis on each advisory, see the dedicated review posts:

Why this matters for Drupal and WordPress​

Drupal agencies and site owners running contrib-heavy stacks need a repeatable triage workflow when advisory batches like this land. Modules like CAPTCHA, SAML SSO, and Islandora are common in enterprise Drupal builds, and missing even one patch can expose XSS or access-bypass vectors. WordPress teams maintaining parallel CMS portfolios should apply the same dependency-scanning discipline across both ecosystems since many hosting and CI pipelines serve both platforms.

References​

Looking for an Architect who doesn't just write code, but builds the AI systems that multiply your team's output? View my enterprise CMS case studies at victorjimenezdev.github.io or connect with me on LinkedIn.