The Image module allows you to define and configure image fields.
Impact
The Image module allows you to define and configure image fields.
Source excerpt · OSVThis vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 10.6.13Ecosystem versions | 10.6.13 |
| From 11.3.0 before 11.3.14Ecosystem versions | 11.3.14 |
| From 11.4.0 before 11.4.4Ecosystem versions | 11.4.4 |
| From 11.0.0 before 11.1.0Ecosystem versions | 11.1.0 |
| From 11.1.0 before 11.2.0Ecosystem versions | 11.2.0 |
| From 11.2.0 before 11.3.0Ecosystem versions | 11.3.0 |
Version evidence: OSV · DRUPAL-CORE-2026-010
View original version evidence (493 explicit versions)
Original source description
The Image module allows you to define and configure image fields.
The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.
This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.
Information disclosure issues like this one are not generally given security advisories (as described in PSA-2023-07-12)). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.