CVE-2025-3057: Drupal Core Cross-Site Scripting (XSS) Vulnerability in Error Messages
Summary
CVE-2025-3057: Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages. Affects drupal/core across 4 version ranges.
>= 8.0.0, < 10.3.13
>= 10.4.0, < 10.4.3
>= 11.0.0, < 11.0.12
>= 11.1.0, < 11.1.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2025-3057 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) that allows users to create and manage websites easily. It is known for its flexibility, scalability, and strong community support. However, like any software, it can have vulnerabilities. This specific vulnerability affects various versions of Drupal Core, making it crucial for users to be aware and take action.
Vulnerability Detail
The vulnerability identified as CVE-2025-3057 is a Cross-Site Scripting (XSS) issue that arises from improper neutralization of input during web page generation. This flaw allows attackers to inject malicious scripts into error messages, which can be executed in the context of the user's browser. The affected versions include Drupal Core from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, and from 11.1.0 before 11.1.3. The potential ramifications include unauthorized access to user data and the ability to manipulate user sessions, leading to further exploitation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.3.1310.3.13composer require drupal/core:10.3.13 -
>= 10.4.0, < 10.4.310.4.3composer require drupal/core:10.4.3 -
>= 11.0.0, < 11.0.1211.0.12composer require drupal/core:11.0.12 -
>= 11.1.0, < 11.1.311.1.3composer require drupal/core:11.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, consider implementing input validation and sanitization on error messages to mitigate the risk of XSS attacks. However, this is not a permanent solution and should only be a temporary measure until the package is updated.
Conclusion
The CVE-2025-3057 vulnerability in Drupal Core presents a significant risk due to its potential for Cross-Site Scripting attacks. Users are strongly advised to update their installations to the latest patched versions to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining the security of web applications.
See every vulnerability recorded for drupal/core →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
You can check your application's composer.lock file against the affected versions listed in the vulnerability details. Additionally, you can use Vulert's playground to monitor for vulnerabilities.
Failure to address this vulnerability may lead to unauthorized access to sensitive user information and potential site compromise.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just the composer.lock file.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
