CVE-2025-31690: Drupal Cache Utility Cross-Site Request Forgery (CSRF) Vulnerability
Summary
CVE-2025-31690: Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability. Affects drupal/cache_utility versions < 1.2.1. Fixed in 1.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Cache Utility is a component of the Drupal content management system that provides caching functionality to enhance performance by storing frequently accessed data. It is widely used in various web applications built on the Drupal framework. However, this package has been identified to have a vulnerability that allows attackers to exploit it through Cross-Site Request Forgery (CSRF), potentially leading to unauthorized actions being performed on behalf of authenticated users.
Vulnerability Detail
The Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows attackers to trick users into executing unwanted actions on a web application in which they are authenticated. This vulnerability arises from the lack of proper validation of requests, enabling malicious actors to send unauthorized commands. If exploited, it could lead to data manipulation or unauthorized access, posing a significant risk to the integrity and security of the application.
How To Fix
Minimum fixed version
1.2.1
This is the first release that contains the fix.
composer require drupal/cache_utility:1.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing CSRF tokens in your application to validate requests. This can be done by adding a unique token to forms and verifying it on the server side before processing any requests.
Conclusion
The CSRF vulnerability in Drupal Cache Utility (CVE-2025-31690) poses a significant risk to web applications using this package. It is crucial to update to version 1.2.1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for drupal/cache_utility →
FAQ
CSRF is a type of attack that tricks the victim into submitting a request that they did not intend to make, potentially leading to unauthorized actions on a web application.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
Failure to address this vulnerability could result in unauthorized access to user accounts, data manipulation, and a breach of user trust, leading to potential legal and reputational repercussions.
Using older versions that are vulnerable to CSRF attacks is not safe. It is highly recommended to update to the latest patched version to ensure security.
If you suspect a compromise, immediately review your application logs, update to the latest version, and consider conducting a security audit to assess any potential damage.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/cache_utility.
