CVE-2026-108515
The Drupal core Link module provides a field type that can be used for internal and external URLs.
Published Oct 14, 2026 · updated Oct 14, 2026 · Drupal Drupal
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · OSV.dev
Detected
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
Oct 14, 2026 · OSV.dev
Fix available
drupal/core fixed in 10.6.19
Oct 14, 2026 · OSV.dev
Fix available
drupal/core fixed in 10.6.19
Oct 14, 2026 · OSV.dev
Updated
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
Affected
- Packagist drupal/core8.9.0 → 10.6.19
Sources
- CVE.orgVulnerability recordCVE-2026-108515
Official CVE identifier
cve.org - Drupal SecurityVendor advisoryCVE-2026-108515
Project: Drupal core Project machine name: drupal <div cl
drupal.org - OSV.devPackage advisoryDRUPAL-CORE-2026-015osv.dev