CVE-2025-48448: Drupal Admin Audit Trail Excessive Resource Allocation Vulnerability
Summary
CVE-2025-48448: Drupal Admin Audit Trail Allocation of Resources Without Limits or Throttling vulnerability. Affects drupal/admin_audit_trail versions < 1.0.5. Fixed in 1.0.5. How to fix ↓
Also tracked for
- drupal/admin_audit_trail · Packagist:https://packages.drupal.org/8
The same CVE-2025-48448 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal Admin Audit Trail is a module designed to track changes made by users in the Drupal content management system. It provides an audit log of user actions, enhancing accountability and security. However, this module is vulnerable to an allocation of resources without limits or throttling, which can lead to excessive resource consumption, potentially affecting the performance and stability of the Drupal application.
Vulnerability Detail
The vulnerability arises from the lack of limits on resource allocation within the Admin Audit Trail module, allowing for excessive allocation of resources. This can lead to denial of service conditions, where legitimate users may experience degraded performance or complete unavailability of the application. The issue affects versions from 0.0.0 up to, but not including, 1.0.5. The vulnerability is classified under CWE-770, indicating a failure to impose limits on resource consumption.
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
composer require drupal/admin_audit_trail:1.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can monitor resource usage and implement server-level limits to mitigate the impact of excessive resource allocation until the module is updated. This may involve configuring server settings to limit memory or CPU usage for the Drupal application.
Conclusion
The Drupal Admin Audit Trail module has a significant vulnerability that allows for excessive resource allocation, potentially leading to performance issues. It is crucial for users to update to the patched version 1.0.5 to mitigate this risk. Monitoring tools like Vulert can assist in identifying vulnerabilities in open-source software without requiring code access.
See every vulnerability recorded for drupal/admin_audit_trail →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions from 0.0.0 up to, but not including, 1.0.5 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include degraded performance, denial of service, and overall instability of the Drupal application.
Yes, a patch is available in version 1.0.5 of the Admin Audit Trail module. It is recommended to update to this version.
