DRUPAL-CONTRIB-2026-319: Composer/drupal/texts vulnerability
Published Nov 11, 2026
·Updated
The Texts module provides key-based strings and translations for Drupal and tools for managing them.
The module does not sufficiently protect an action to restore a duplicate translation. A crafted request can cause a user with access to the translation overview to overwrite an existing translation and delete the duplicate, even if that user cannot edit or delete translations.
This vulnerability is mitigated by the fact that an attacker must first create a suitable duplicate translation and induce a user with access to the translation overview to open the crafted request.
Affected Software
1 affected componentFixes available
composer/drupal/texts>=1.0.13<1.0.17
1.0.17
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/textsto a version that resolves this vulnerability.Fixed in 1.0.17
Event History
Nov 11, 2026
Advisory Published
via OSV·05:42 PM
Data Sourced
via OSV·05:42 PM
DescriptionAffected Software