SA-CONTRIB-2026-327: Critical severity composer/drupal/entity_print vulnerability
This module enables you to print and export Drupal entities to PDF and other formats, using print engines such as Dompdf. When generating a PDF for a page that contains third-party resources, the module sends several kinds of private data to the third-party server (including the user's session cookie and their Dompdf HTTP authentication credentials), regardless of the host those resources are loaded from. A third-party site referenced in printed content can therefore obtain the session data of users printing that content and use it to impersonate them. This vulnerability is mitigated by the fact that to deliberately exploit this vulnerability, an attacker must be able to create or edit content using a text format that allows images or stylesheets from arbitrary sites (such as "Full HTML").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/entity_printto a version that resolves this vulnerability.Fixed in 8.x-2.20 - Compensating control
Prevent attackers or untrusted users from creating or editing content with text formats that allow images or stylesheets from arbitrary sites, such as "Full HTML".
Event History
Frequently Asked Questions
Who is most exposed to session impersonation through this issue?
Users who generate PDFs from pages containing third-party resources are exposed, particularly where untrusted users can add external images or stylesheets to printable content. A third-party site referenced by that content can receive the printing user's session cookie and Dompdf HTTP authentication credentials.
What access does an attacker need to exploit this deliberately?
The attacker must be able to create or edit content using a text format that permits images or stylesheets from arbitrary sites, such as Full HTML. They also need a user to generate a PDF from content that references the attacker-controlled third-party resource.
What can be done if an update is not immediately available?
Restrict who can create or edit content with text formats that allow arbitrary external images or stylesheets. Avoid printing content that includes third-party resources until the issue is addressed.