Threats tagged 'drupal-contrib-2026-327'

The Drupal Entity Print module before version 2.20.0 has a vulnerability where it sends private user data, including session cookies and Dompdf HTTP authentication credentials, to third-party servers when generating PDFs containing third-party resources. This can allow those third-party sites to impersonate users. Exploitation requires the attacker to create or edit content using a text format that permits embedding images or stylesheets from arbitrary sites, such as "Full HTML."