CVE-2025-13082: Drupal

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

Affected products

• Drupal Drupal: from 8.0.0, before 10.4.9 (fixed in 10.4.9); from 10.5.0, before 10.5.6 (fixed in 10.5.6); from 11.0.0, before 11.1.9 (fixed in 11.1.9); from 11.2.0, before 11.2.8 (fixed in 11.2.8)

Published 2025-11-18. Last modified 2026-06-17.