{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a8bd5c49-df52-5dcd-bf45-373f92024c97", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "core", "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "type": "library", "group": "drupal", "bom-ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "version": "10.6.17-p1+tuxcare", "pedigree": { "ancestors": [ { "name": "core", "purl": "pkg:composer/drupal/core@10.6.17", "type": "library", "group": "drupal", "version": "10.6.17" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25270", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:3d992835-4690-5b2b-9cf3-92ad42c689b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25270 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.6.17 is NOT AFFECTED by CVE-2022-25270. The vulnerable QuickEdit module was completely removed from Drupal 10.x before version 10.0.0 was released (removed on 2022-08-29, Drupal 10.0.0 released 2022-12-15). The target contains zero QuickEdit files; the vulnerable file `modules/quickedit/src/MetadataGenerator.php` does not exist. This satisfies Rule 5 Type A1: the INPUT type...", "justification": "code_not_present" } }, { "id": "CVE-2022-25271", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:dba00f63-da51-533e-97c5-587bcd5466c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25271 affects version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2022-25273", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:2f0a8fee-6fc9-520f-a0fb-262b4c86dc0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25273 affects version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2022-25275", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:b708361d-5cf5-5a21-9fa2-ddee5d66de3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25275 affects version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2022-25276", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:a845ca0f-d68e-518e-9121-ebc302cf2479", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25276 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25276 is not present in drupal/core 10.6.17-p1+tuxcare. The vulnerability concerned missing domain validation in the Media oEmbed iframe controller's render() method. The fix (domain validation logic at lines 126-134 of OEmbedIframeController.php) was already included in the upstream Drupal 10.6.17 release, which this TuxCare branch was initialized from via snapshot commit 88bf9d33ba. ...", "justification": "code_not_present" } }, { "id": "CVE-2022-25277", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:d8a19493-d6d6-5546-858a-2a8d43868e3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25277 affects version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2022-25278", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:25812d15-47a4-511c-b045-0904bd1f5986", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25278 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25278 is not present in Drupal 10.6.17. The vulnerability involved improper evaluation of form element access control - the code treated AccessResultInterface objects as truthy boolean values instead of calling isAllowed(). The upstream fix was already included in Drupal 10.6.17 when TuxCare onboarded this version. The target code at lib/Drupal/Core/Form/FormBuilder.php:1228 correctly ...", "justification": "code_not_present" } }, { "id": "CVE-2023-5256", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:fdcb3ba6-6826-5bdd-b170-5f5280a1b49f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-5256 affects version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2024-12393", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:6f388f68-1a9c-5a70-b7c2-bf0415834130", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-12393 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-12393 affects Drupal Core's MessageCommand class where status messages rendered via JavaScript lacked adequate sanitization, allowing XSS attacks. The target (drupal/core 10.6.17-p1+tuxcare) is NOT AFFECTED because the fix was already present in upstream Drupal 10.6.17 before TuxCare onboarded this version. The MessageCommand::render() method correctly applies Xss::filterAdmin() saniti...", "justification": "code_not_present" } }, { "id": "CVE-2024-45440", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:c9caf3a7-8290-5de7-b963-d11cece9ab6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-45440 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The upstream vendor's fix (Drupal issue #3457781, commit 8830f76c72) was already included in Drupal 10.6.17, which TuxCare onboarded. The fix strips full filesystem paths from error messages by converting them to relative paths, sets up error handlers early in install.php, and ensures DrupalKernel::bootEnvi...", "justification": "code_not_present" } }, { "id": "CVE-2024-55634", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:6d831fcc-31f1-5848-9444-720ae9128532", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-55634 affects version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2024-55636", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:3048e973-b796-5ccc-ac69-0691943d853e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-55636 affects version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2024-55637", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:2f9313cb-cd21-546c-a2ac-b4f4e08037bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-55637 affects version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2024-55638", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:cbb29a31-6ec1-5bfd-afe4-2a3a67cf7111", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-55638 affects version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2025-13080", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:50beb5eb-19ae-50c7-ae6a-1169b82cc5fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-13080 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13080 is not present in this target. The security fix for the HTTP method override vulnerability (SA-CORE-2025-005) was already included in the upstream Drupal 10.6.17 release that TuxCare onboarded. The fix adds validation in RequestSanitizer::sanitize() to reject requests that override their HTTP method from an unsafe method to a safe method, preventing CSRF bypass attacks. This prot...", "justification": "code_not_present" } }, { "id": "CVE-2025-13081", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:db7c8fb7-07be-5c44-aae1-a5c4c2c46c54", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-13081 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13081. The vulnerability (unsafe Transaction object deserialization) was fixed by upstream Drupal in SA-CORE-2025-006 (November 2025) by adding a __wakeup() method that prevents Transaction objects from being unserialized. This fix was already present in the upstream Drupal 10.6.17 release (September 2026) that TuxCare subseq...", "justification": "code_not_present" } }, { "id": "CVE-2025-13082", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:e7b51ca6-526a-541f-9343-cea19b0ef6dd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-13082 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13082. The vulnerability (content spoofing via user-controlled format strings in error messages) was already fixed in the upstream Drupal 10.6.17 release through SA-CORE-2025-007. All three affected files contain the patched code that removes user input from error messages to prevent content spoofing.", "justification": "code_not_present" } }, { "id": "CVE-2025-13083", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:510b51a3-1135-5f24-95a3-a1562bf06717", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-13083 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 Target Drupal core 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2025-13083. The vulnerability fix (SA-CORE-2025-008) was already present in the upstream Drupal 10.6.17 release before TuxCare onboarding. The FileDownloadController.php contains the complete fix: proper Cache-Control header management that prevents sensitive files from being cached in browsers/proxies by explicitly setting responses ...", "justification": "code_not_present" } }, { "id": "CVE-2025-3057", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:2dbafc21-0ee8-5bda-8d30-03f3b9b70c79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-3057 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.6.17 is not affected by CVE-2025-3057 (XSS via HTTP exception messages). Both required defense mechanisms from the upstream fix are present: (1) DrupalKernel.php:782 sets Content-Type to 'text/plain' for all HttpException responses, preventing browsers from interpreting exception messages as HTML; (2) DefaultExceptionHtmlSubscriber.php:93 prevents 400 Bad Request errors fro...", "justification": "code_not_present" } }, { "id": "CVE-2025-31673", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:42e9e7d7-77ac-51bf-b16c-27bfdb4c06b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31673 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-31673: The target Drupal 10.6.17 is not affected. The vulnerability (missing assignment in FieldUpdateActionBase.php line 56 causing incorrect authorization checks) was fixed by upstream Drupal in February 2025 (SA-CORE-2025-002), 7 months before the 10.6.17 release in September 2026. The fix was already present in the upstream 10.6.17 release that TuxCare onboarded. The target code co...", "justification": "code_not_present" } }, { "id": "CVE-2025-31674", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:0e311ac1-78eb-5895-b90c-d4fedba86751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31674 affects version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2025-31675", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:cc4747ed-6a01-5f88-82e9-10b386b0f9bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31675 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-31675 (SA-CORE-2025-004) affects Drupal core 8.0.0-11.1.5 via XSS in link field attributes. The target repository at version 10.6.17-p1+tuxcare is NOT affected because the upstream vendor fix was already included in the Drupal 10.6.17 release that TuxCare onboarded in September 2026. The fix (AttributeXss.php sanitization + calls in LinkFormatter.php and MenuLinkContent.php) is present...", "justification": "code_not_present" } }, { "id": "CVE-2026-108097", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:d0732e87-bdd1-5626-8ede-3fd5ff2469d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-108097 is fixed in version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2026-108514", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:1722f917-15a5-5caf-a214-ac450b329eeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-108514 is fixed in version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2026-108515", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:3e3d0910-0836-5dd7-824f-010a4c1d4852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-108515 is fixed in version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "CVE-2026-6365", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:a731daed-437f-5a0f-b83b-62afe94bb0f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6365 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target repository (Drupal core 10.6.17-p1+tuxcare) is NOT AFFECTED by CVE-2026-6365. The XSS vulnerability in the OpenDialogCommand class was already fixed in upstream Drupal version 10.6.7, and version 10.6.17 shipped with the fix already applied. The CVE states that versions \"from 10.6.0 before 10.6.7\" are affected, confirming that 10.6.17 is safe. When TuxCare onboarded version 10.6.17 v...", "justification": "code_not_present" } }, { "id": "CVE-2026-6366", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:b5fe499e-c1e3-51f5-9040-117f15e46539", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6366 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2026-6366 affects Drupal core versions from 10.6.0 before 10.6.7. The target repository is at version 10.6.17-p1+tuxcare, which includes the upstream fix that was released in Drupal 10.6.7 on 2026-04-15. The fix adds validation during object unserialization (__wakeup in ViewExecutable.php) to prevent property injection, and type checking during rendering (__toString in Attribute.php) to pre...", "justification": "code_not_present" } }, { "id": "CVE-2026-9082", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:1f762f2f-126d-5caf-87ae-d059e2d41cb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-9082 affects version 10.6.17-p1+tuxcare of drupal/core." } }, { "id": "GHSA-6ccv-8fgf-cjpw", "affects": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ], "bom-ref": "urn:uuid:d7799ee1-48ae-505f-94da-20e799fe0241", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by GHSA-6ccv-8fgf-cjpw. The vulnerability, which could cause denial of service through unhandled NotFoundHttpException in PathBasedBreadcrumbBuilder, was fixed upstream in SA-CORE-2024-001 (commit bd803acb29) and was already present in Drupal 10.6.17 when TuxCare onboarded it. The fix adds exception handling for NotFoundHttpException in ...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } ] }