CVE-2025-13082: Drupal Core Content Spoofing Vulnerability
Summary
CVE-2025-13082: Drupal core allows Content Spoofing. Affects drupal/core across 4 version ranges.
>= 8.0.0, < 10.4.9
>= 10.5.0, < 10.5.6
>= 11.0.0, < 11.1.9
>= 11.2.0, < 11.2.8
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2025-13082 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that enables users to create and manage websites easily. It is known for its flexibility and scalability, making it suitable for a variety of applications, from personal blogs to enterprise-level websites. However, certain versions of Drupal core are vulnerable to a content spoofing issue, which can misrepresent critical information in the user interface, potentially leading to user deception.
Vulnerability Detail
The vulnerability identified as CVE-2025-13082 is a User Interface (UI) Misrepresentation of Critical Information issue in Drupal core. This vulnerability affects versions of Drupal core from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, and from 11.2.0 before 11.2.8. The flaw allows attackers to spoof content, which can mislead users and compromise the integrity of the information presented on the website. This can have serious ramifications, particularly in scenarios where users rely on accurate information for decision-making.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.4.910.4.9composer require drupal/core:10.4.9 -
>= 10.5.0, < 10.5.610.5.6composer require drupal/core:10.5.6 -
>= 11.0.0, < 11.1.911.1.9composer require drupal/core:11.1.9 -
>= 11.2.0, < 11.2.811.2.8composer require drupal/core:11.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement additional validation checks on user-generated content to minimize the risk of content spoofing until they can apply the necessary updates.
Conclusion
The CVE-2025-13082 vulnerability in Drupal core poses a significant risk due to its potential for content spoofing. It is crucial for users to update their installations to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for drupal/core →
FAQ
Content spoofing is a technique used by attackers to misrepresent information on a website, potentially leading users to make incorrect decisions based on false data.
The vulnerability affects Drupal core versions from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, and from 11.2.0 before 11.2.8.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your composer.lock file, Vulert can alert you in real-time about any vulnerabilities, including this one.
If you cannot update your Drupal core immediately, consider implementing additional validation checks on user-generated content as a temporary workaround.
More information about CVE-2025-13082 can be found in the official advisory on GitHub and other security databases.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
