CVE-2025-10931: Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS). This issue affects Umami Analytics: from 0.0.0 before 1.0.1.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10931?
The severity of CVE-2025-10931 is classified as medium due to its potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2025-10931?
To fix CVE-2025-10931, upgrade Drupal Umami Analytics to version 1.0.1 or later.
What software is affected by CVE-2025-10931?
CVE-2025-10931 affects Drupal Umami Analytics versions from 0.0.0 up to, but not including, 1.0.1.
What type of vulnerability is CVE-2025-10931?
CVE-2025-10931 is a Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation.
Who should be concerned about CVE-2025-10931?
Site administrators and developers using affected versions of Drupal Umami Analytics should be concerned about CVE-2025-10931.