SA-CONTRIB-2026-246: Critical severity drupal/tinypng vulnerability

Q: Which deployments are affected by this issue?

The issue is mitigated unless Drupal is configured to serve private derived images through a contributed, non-core file scheme. Deployments that do not use such a file scheme are not described as affected by this condition.

Q: What configuration should be reviewed during triage?

Review how private image style derivatives are served and determine whether they use a contributed file stream rather than the core private:// scheme. The described access-check weakness applies when those derivatives are served through a non-private:// file stream.

Published Oct 21, 2026

Updated

TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://. This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.

Credit

Pierre Rudloff (prudloff)(the Drupal Security Team)

Affected Software

1 affected componentFixes available

drupal/tinypng<2.0.2

2.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/tinypng to a version that resolves this vulnerability.
Fixed in 2.0.2
Configuration
Configure Drupal to use a contributed (non-core) file scheme when serving private image style derivatives.
Drupal file scheme for private derived images = contributed (non-core) file scheme

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected by this issue?

The issue is mitigated unless Drupal is configured to serve private derived images through a contributed, non-core file scheme. Deployments that do not use such a file scheme are not described as affected by this condition.

What configuration should be reviewed during triage?

Review how private image style derivatives are served and determine whether they use a contributed file stream rather than the core private:// scheme. The described access-check weakness applies when those derivatives are served through a non-private:// file stream.

SA-CONTRIB-2026-246: Critical severity drupal/tinypng vulnerability

Credit

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected by this issue?

What configuration should be reviewed during triage?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected by this issue?

What configuration should be reviewed during triage?