LowDRUPAL-CORE-2022-013BIT-drupal-2022-25278CVE-2022-25278GHSA-cfh2-7f6h-3m85
DRUPAL-CORE-2022-013 in drupal/core
Published 20 Jul 2022 · Updated 19 Sept 2026
Affected package
drupal/coreComposer
- Affected
- >=8.0.0 <9.3.19 · >=9.4.0 <9.4.3
- Fixed in
- 9.3.19, 9.4.3
Update to the fixed version for your release line, for example:
composer require drupal/core:^9.4.3Details
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to.
No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
This advisory is not covered by [Drupal Steward](/steward).
Is DRUPAL-CORE-2022-013 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected drupal/core, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.