DRUPAL-CONTRIB-2026-327: Composer/drupal/entity_print vulnerability

Q: Who is realistically exposed to this issue?

Sites using the module are exposed when users generate PDFs for content that includes third-party resources. Deliberate exploitation additionally requires an attacker to be able to create or edit content using a text format that permits images or stylesheets from arbitrary sites, such as Full HTML.

Q: What does an attacker need to exploit it?

The attacker needs to place or modify printable content so it references resources hosted on a server they control. When a user prints that content, the module may send the user's session cookie and Dompdf HTTP authentication credentials to that server.

Q: Are default content restrictions sufficient to mitigate deliberate exploitation?

The issue is mitigated where untrusted users cannot create or edit content with a text format that allows arbitrary external images or stylesheets. Review which roles can use formats such as Full HTML and whether those roles can create printable content.

Published Nov 11, 2026

Updated

This module enables you to print and export Drupal entities to PDF and other formats, using print engines such as Dompdf.

When generating a PDF for a page that contains third-party resources, the module sends several kinds of private data to the third-party server (including the user's session cookie and their Dompdf HTTP authentication credentials), regardless of the host those resources are loaded from. A third-party site referenced in printed content can therefore obtain the session data of users printing that content and use it to impersonate them.

This vulnerability is mitigated by the fact that to deliberately exploit this vulnerability, an attacker must be able to create or edit content using a text format that allows images or stylesheets from arbitrary sites (such as "Full HTML").

Affected Software

1 affected componentFixes available

composer/drupal/entity_print<2.20.0

2.20.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/entity_print to a version that resolves this vulnerability.
Fixed in 2.20.0

Event History

Nov 11, 2026

Advisory Published

via OSV·05:53 PM

Data Sourced

via OSV·05:53 PM

DescriptionAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Sites using the module are exposed when users generate PDFs for content that includes third-party resources. Deliberate exploitation additionally requires an attacker to be able to create or edit content using a text format that permits images or stylesheets from arbitrary sites, such as Full HTML.

What does an attacker need to exploit it?

The attacker needs to place or modify printable content so it references resources hosted on a server they control. When a user prints that content, the module may send the user's session cookie and Dompdf HTTP authentication credentials to that server.

Are default content restrictions sufficient to mitigate deliberate exploitation?

The issue is mitigated where untrusted users cannot create or edit content with a text format that allows arbitrary external images or stylesheets. Review which roles can use formats such as Full HTML and whether those roles can create printable content.

DRUPAL-CONTRIB-2026-327: Composer/drupal/entity_print vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Are default content restrictions sufficient to mitigate deliberate exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Are default content restrictions sufficient to mitigate deliberate exploitation?