N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-13082

CVE-2025-13082: Drupal core allows Content Spoofing

User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-13082

CVE-2025-13082:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
drupal/core	composer	>= 8.0.0, < 10.4.9	10.4.9
drupal/core	composer	>= 10.5.0, < 10.5.6	10.5.6
drupal/core	composer	>= 11.0.0, < 11.1.9	11.1.9
drupal/core	composer	>= 11.2.0, < 11.2.8	11.2.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2025-13082, is a content spoofing issue in Drupal core. The root cause is the reflection of unsanitized user input from the requested URL format into HTTP exception messages. When a user visits a specially crafted URL with a malicious format specifier (e.g., containing HTML tags), Drupal's exception handling mechanism includes this raw format string in the error page sent back to the user's browser. The browser then renders this injected HTML, allowing an attacker to deface the page or present misleading information.

The security patch addresses this by removing the dynamic, user-controlled format string from the exception messages in three key locations. Instead of reflecting the input, the updated code now returns static, generic error messages. The identified vulnerable functions are the exact locations where this reflection occurred. Any runtime profile during exploitation would show one of these functions throwing either a NotAcceptableHttpException or a BadRequestHttpException just before the malicious content is rendered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.