CVE-2025-31688: Drupal Configuration Split CSRF Vulnerability
Summary
CVE-2025-31688: Drupal Configuration Split Cross-Site Request Forgery (CSRF) vulnerability. Affects drupal/config_split across 2 version ranges.
< 1.10.0
>= 2.0.0, < 2.0.2
Fixed in 1.10.0 or 2.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Configuration Split is a module that allows developers to manage different configurations for various environments in Drupal. It enables the separation of configuration settings, making it easier to deploy changes across different stages of development. However, this module has been found to be vulnerable to a Cross-Site Request Forgery (CSRF) attack, which can compromise the integrity of the application by allowing unauthorized actions to be performed on behalf of a user.
Vulnerability Detail
The Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows attackers to trick users into executing unwanted actions on a web application in which they are authenticated. This vulnerability arises from insufficient validation of requests, allowing an attacker to exploit the trust that a web application has in the user's browser. If exploited, this could lead to unauthorized changes in configurations, potentially compromising the security and functionality of the Drupal site.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.10.01.10.0composer require drupal/config_split:1.10.0 -
>= 2.0.0, < 2.0.22.0.2composer require drupal/config_split:2.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can limit access to the affected module by restricting permissions for users who do not require access to configuration changes. This can help mitigate the risk until the module is updated.
Conclusion
The CSRF vulnerability in Drupal Configuration Split poses a significant risk to applications using this module. It is crucial for users to update to the latest patched versions to safeguard their applications against potential attacks. By following the recommended steps and utilizing tools like Vulert, developers can effectively manage and mitigate vulnerabilities in their software.
See every vulnerability recorded for drupal/config_split →
FAQ
CSRF is a type of attack that tricks a user into executing unwanted actions on a web application in which they are authenticated, potentially leading to unauthorized changes.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your composer.lock file, you can receive alerts for any vulnerabilities, including this one.
If left unaddressed, this vulnerability could allow attackers to make unauthorized changes to your Drupal configurations, potentially compromising the security and functionality of your site.
Yes, you can restrict access to the Configuration Split module for users who do not need to make configuration changes, reducing the risk of exploitation.
Detailed information about this vulnerability can be found in the advisory database on GitHub or by visiting the official Drupal security pages.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/config_split.
