SA-CONTRIB-2026-188: Critical severity drupal/combined_image_style vulnerability
This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token, potentially leading to a denial of service. Sites are affected simply by having the module installed, even when no combined image styles are configured or in use. This vulnerability is mitigated by the fact that only public files can be targeted, and derivatives of private files are still protected by core's token check.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/combined_image_styleto a version that resolves this vulnerability.Fixed in 1.0.7
Event History
Frequently Asked Questions
Are sites affected if they do not use combined image styles?
Yes. A site is affected simply by having the module installed, even when no combined image styles are configured or in use.
What access does an attacker need to exploit this issue?
The issue can be exploited by anonymous users. They may be able to generate image derivatives without a valid token under certain circumstances.
Which files can be targeted?
Only public files can be targeted. Derivatives of private files remain protected by Drupal core's token check.