Executive brief
Drupal's Image module, used to manage image fields and transformations on websites, fails to properly verify access permissions when serving processed image files through certain file storage systems. An attacker could potentially access image derivatives that should be restricted, bypassing authorization controls intended to limit who can view specific images.
Technical details
The Image module in Drupal core does not sufficiently validate authorization when serving image style derivatives via non-private file streams (file schemes other than private://). The vulnerability is rooted in insufficient access checks during file serving. The attack vector is network-based and requires no authentication, though exploitation is mitigated by the requirement that Drupal must be configured with a contributed (non-core) file scheme to serve private derived images. An attacker can access image style derivatives without proper authorization. Patches are available in Drupal 10.6.13, 11.3.14, and 11.4.4.
Affected products
- Drupal Drupal before 10.6.13, 11.3.0 before 11.3.14, 11.4.0 before 11.4.4, 11.0.*, 11.1.*, 11.2.*
Timeline
- 2026-07-15: disclosed
- 2026-08-25: patched: Patches released for Drupal 10.6.13, 11.3.14, and 11.4.4
- 2026-08-25: advisory