{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:801c8e77-fe07-5859-a28b-5d6f6648c6bc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "core", "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "type": "library", "group": "drupal", "bom-ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "version": "10.5.12-p2+tuxcare", "pedigree": { "ancestors": [ { "name": "core", "purl": "pkg:composer/drupal/core@10.5.12", "type": "library", "group": "drupal", "version": "10.5.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25270", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:6c890177-59fe-5810-bd90-2a6075b15711", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25270 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal core version 10.5.12 is NOT affected by CVE-2022-25270. The vulnerability exists in the Quick Edit module's MetadataGenerator class, which fails to perform proper access checks before exposing entity labels. However, the Quick Edit module was completely removed from Drupal core in version 10.0.0-beta1 (August 2022), which is well before the target version 10.5.12. The vulnerab...", "justification": "code_not_present" } }, { "id": "CVE-2022-25271", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:0615f485-2d8b-537b-8f88-da4239d60596", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25271 affects version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2022-25273", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:a7617636-1657-5666-ba1c-50e95d344de1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25273 affects version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2022-25275", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:c09a7acc-dad4-5fe6-8132-f628a866ed79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25275 affects version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2022-25276", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:0144544b-2c73-5816-a9a7-0f1036229e09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25276 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25276 affects Drupal's Media oEmbed iframe route due to missing domain validation. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED because the security fix from SA-CORE-2022-015 was already present in upstream Drupal 10.5.12 when TuxCare onboarded it. The domain validation logic (lines 127-134 of OEmbedIframeController.php) validates that requests to the oEmbed i...", "justification": "code_not_present" } }, { "id": "CVE-2022-25277", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:066a7040-68b9-570b-945b-900361d3ff31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25277 affects version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2022-25278", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:2733ac53-72db-5a21-88d7-cdd8cbcdbefc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25278 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25278 does not affect this Drupal 10.5.12 target. The vulnerability (incorrect form element access evaluation) was fixed in upstream Drupal via SA-CORE-2022-013 (July 2022), before Drupal 10's initial release (December 2022). The target code shows proper AccessResultInterface->isAllowed() checking in FormBuilder.php lines 1224-1229, matching the patched version. TuxCare onboarded the a...", "justification": "code_not_present" } }, { "id": "CVE-2023-5256", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:c163b9f5-aa02-5af9-861b-03e71ba039d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-5256 affects version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2024-12393", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:5e68c341-a14f-5989-bae3-a2809fa997f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-12393 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2024-12393 (SA-CORE-2024-003) is not present in the target. The vulnerability concerns inadequate sanitization of status messages in Drupal's AJAX MessageCommand, allowing XSS attacks. The fix (applying Xss::filterAdmin to string messages while preserving safe MarkupInterface objects) was released upstream in November 2024 for Drupal 10.2.11 and 10.3.9. The target version (10.5.12) was rele...", "justification": "code_not_present" } }, { "id": "CVE-2024-45440", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:aa710771-f2cf-5720-a2c6-210cc42abc8d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-45440 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The fix was already included in the upstream Drupal 10.5.12 release via commit 8830f76c72 by Alex Pott (alex.a.pott@googlemail.com) on 2024-10-02. TuxCare onboarded this already-fixed version via snapshot commit b5de532105, which captured the upstream release state including all security fixes.", "justification": "code_not_present" } }, { "id": "CVE-2024-55634", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:410930ef-653c-5a90-99db-3a24df8e4e73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-55634 affects version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2024-55636", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:25ed181f-9fc3-50ea-b3d5-f4ea39631dcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-55636 affects version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2024-55637", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:c0b87402-d0d3-56da-a821-e5e2f332d2f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-55637 affects version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2024-55638", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:2039fb47-f761-53d8-af64-10363276d9f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-55638 affects version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2025-13080", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:0bca0514-98f6-57b9-8ce6-a8062d67d09d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-13080 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target drupal/core 10.5.12-p2+tuxcare is NOT vulnerable to CVE-2025-13080. The vulnerability (HTTP method override to safe methods allowing forceful browsing) was fixed in upstream Drupal 10.5.12, which is the base version TuxCare onboarded. The fix is present at lib/Drupal/Core/Security/RequestSanitizer.php:44-46, rejecting requests where getMethod() != getRealMethod() and the overridden m...", "justification": "code_not_present" } }, { "id": "CVE-2025-13081", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:f9839d13-84ad-517b-98e5-bf141c003f72", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-13081 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13081 (Object Injection via Transaction deserialization) does not affect Drupal 10.5.12. The vulnerability affects versions 10.5.0 before 10.5.6, but the target is version 10.5.12, which already contains the upstream fix. The fix (adding __wakeup() to prevent Transaction object unserialization) was present in upstream Drupal 10.5.12 when TuxCare onboarded it via snapshot commit b5de532...", "justification": "code_not_present" } }, { "id": "CVE-2025-13082", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:fb4927c7-fcff-5606-b4f0-b94333124bc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-13082 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13082 is a content spoofing vulnerability affecting Drupal core versions prior to SA-CORE-2025-007 (November 2025). The vulnerability allows attackers to inject arbitrary text into HTTP error responses by supplying malicious format parameters. The target repository (Drupal 10.5.12-p2+tuxcare) is NOT AFFECTED because the upstream Drupal 10.5.12 release (June 2026) already contained the ...", "justification": "code_not_present" } }, { "id": "CVE-2025-13083", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:15dc1875-958c-5089-8670-e531873e62ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-13083 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.5.12-p2+tuxcare is NOT affected by CVE-2025-13083. This vulnerability (SA-CORE-2025-008) affects Drupal versions 10.5.0-10.5.5, and the fix was released in upstream version 10.5.6. The target version 10.5.12 already contains the complete fix in modules/system/src/FileDownloadController.php (lines 81-95), which properly manages Cache-Control headers for file downloads t...", "justification": "code_not_present" } }, { "id": "CVE-2025-3057", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:827e797a-65e2-5362-99a1-eea48d1f8002", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-3057 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 Target drupal/core 10.5.12-p2+tuxcare is not affected by CVE-2025-3057 (XSS via error messages). The security fix (forcing Content-Type: text/plain for HTTP exception responses and preventing subrequests for 400 errors) was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The vulnerable code pattern is not present in HEAD.", "justification": "code_not_present" } }, { "id": "CVE-2025-31673", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:42d8fff6-90a3-5bd2-9107-65435d9ef8da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31673 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is NOT vulnerable to CVE-2025-31673. The vulnerability affects Drupal versions \"from 10.4.0 before 10.4.3\". The security fix (SA-CORE-2025-002) was released on 2025-02-18 with Drupal 10.4.3. The target version 10.5.12 was released on 2026-06-17, well after the fix was applied upstream. The file lib/Drupal/Core/Field/FieldUpdateActionBase.php:56 contains the fixed code that proper...", "justification": "code_not_present" } }, { "id": "CVE-2025-31674", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:4fe1d685-3786-5aa4-bc8b-01d14d7042d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31674 affects version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2025-31675", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:c4605037-c093-5f11-be8c-a79567f46e41", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31675 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is not affected by CVE-2025-31675. The security fix (SA-CORE-2025-004) for the XSS vulnerability in link field attributes was released in March 2025. Drupal 10.5.12 was released in July 2026, 15+ months after the fix, and therefore already includes the AttributeXss sanitization class and its proper application in LinkFormatter and MenuLinkContent. The CVE's affected version range...", "justification": "code_not_present" } }, { "id": "CVE-2026-108097", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:22881654-ea9e-5bbd-a2b6-50c972a2ff19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-108097 is fixed in version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2026-108514", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:e77a9cf7-8c51-5763-9bfa-e47a3f323e4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-108514 is fixed in version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2026-108515", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:ccb13f35-d2e5-50f6-a5ec-90f86716b9f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-108515 is fixed in version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2026-15916", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:f37666cb-f3e9-52f6-9a7e-bbead54180f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-15916 is fixed in version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2026-55805", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:f4784182-3d1c-559a-a5dd-da88dfe6cb63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55805 is fixed in version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "CVE-2026-6365", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:b5b04974-37da-563b-af99-16cf1cf28825", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6365 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2026-6365 (XSS in jQuery AJAX modal dialog buttons) is NOT present in target Drupal 10.5.12-p2+tuxcare. The SA-CORE-2026-001 fix (button attribute whitelisting + XSS filtering) was included in upstream Drupal 10.5.9 (released 2026-04-15) and is present in the target at lib/Drupal/Core/Ajax/OpenDialogCommand.php lines 146-157. The fix was authored by upstream (xjm@65776.no-reply.drupal.org) ...", "justification": "code_not_present" } }, { "id": "CVE-2026-6366", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:85c6e497-4f4f-5cf4-a537-edd29cd5f8d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6366 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.5.12-p2+tuxcare is not affected by CVE-2026-6366 (Object Injection via PHP unserialization). The SA-CORE-2026-002 security fix was shipped in upstream Drupal 10.5.9, and the target is based on Drupal 10.5.12 which includes this fix. Both defense mechanisms are present: (1) ViewExecutable::__wakeup() validates that unserialized properties match expected defaults and whitelis...", "justification": "code_not_present" } }, { "id": "CVE-2026-9082", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:d4859b3b-bde2-5586-9083-02062720a715", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-9082 affects version 10.5.12-p2+tuxcare of drupal/core." } }, { "id": "GHSA-6ccv-8fgf-cjpw", "affects": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ], "bom-ref": "urn:uuid:726bdd0f-9909-5d89-a58c-707bb1a560f2", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target is not affected by GHSA-6ccv-8fgf-cjpw (Drupal Comment module DoS via PathBasedBreadcrumbBuilder). The vulnerability pattern\u2014unhandled NotFoundHttpException in breadcrumb path resolution\u2014is not present because the upstream Drupal vendor fixed it in SA-CORE-2024-001 (commit bd803acb29) before the 10.5.12 release. TuxCare onboarded version 10.5.12 which already included this fix. The f...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } ] }