CVE-2026-126736: Composer/drupal/entity_print vulnerability
This module enables you to print and export Drupal entities to PDF and other formats, using print engines such as Dompdf.
When generating a PDF for a page that contains third-party resources, the module sends several kinds of private data to the third-party server (including the user's session cookie and their Dompdf HTTP authentication credentials), regardless of the host those resources are loaded from. A third-party site referenced in printed content can therefore obtain the session data of users printing that content and use it to impersonate them.
This vulnerability is mitigated by the fact that to deliberately exploit this vulnerability, an attacker must be able to create or edit content using a text format that allows images or stylesheets from arbitrary sites (such as "Full HTML").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/entity_printto a version that resolves this vulnerability.Fixed in 2.20.0
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker must be able to create or edit content in a text format that permits images or stylesheets from arbitrary external sites, such as Full HTML. They can then reference resources hosted on a server they control.
What data could be exposed during PDF generation?
When a PDF is generated from content containing third-party resources, the module may send the user's session cookie and Dompdf HTTP authentication credentials to the external resource server. A malicious server could use obtained session data to impersonate the user.
Are sites using restricted content formats affected in the same way?
Deliberate exploitation is mitigated where untrusted users cannot create or edit content using a format that allows arbitrary external images or stylesheets. The provided information specifically identifies permissive formats such as Full HTML as the relevant prerequisite.