SA-CONTRIB-2026-224: Critical severity drupal/abc vulnerability

Q: Who is realistically exposed to this issue?

Drupal sites using the ABC theme are exposed where users can create or modify menu link titles through menu administration or permitted content menu settings. Users without either capability cannot supply the affected input.

Q: What access does an attacker need to exploit it?

An attacker needs permission to create or change a menu link title. The issue is mitigated by that required access; no lower-privilege or anonymous attack path is described.

Published Oct 21, 2026

Updated

The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles, either through menu administration or through content menu settings where permitted.

Credit

Drew Webber (mcdruid)(the Drupal Security Team)

Affected Software

1 affected componentFixes available

drupal/abc<8.x-1.25, <2.0.1

8.x-1.252.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/abc to a version that resolves this vulnerability.
Fixed in 8.x-1.25Fixed in 2.0.1

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114525

Frequently Asked Questions

Who is realistically exposed to this issue?

Drupal sites using the ABC theme are exposed where users can create or modify menu link titles through menu administration or permitted content menu settings. Users without either capability cannot supply the affected input.

What access does an attacker need to exploit it?

An attacker needs permission to create or change a menu link title. The issue is mitigated by that required access; no lower-privilege or anonymous attack path is described.

SA-CONTRIB-2026-224: Critical severity drupal/abc vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is realistically exposed to this issue?

What access does an attacker need to exploit it?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What access does an attacker need to exploit it?