CVE-2026-114548 Drupal CVE debrief

Who should care

Drupal site administrators and security teams should assess exposure, particularly those using the imageapi_optimize_webp module in configurations that serve image derivatives from custom or temporary file schemes behind shared caches.

Why it matters

CVE-2026-114548 allows unauthorized access to cached files in Drupal sites using the imageapi_optimize_webp module under specific configurations. Defenders should verify exposure, prioritize updates, and review cache settings.

• Potential unauthorized access to sensitive files through cached WebP derivatives.
• Risk of data exposure in shared cache environments.
• Need for verification of current module version and site configurations.
• Prioritization of updates and cache configuration reviews.

Technical summary

The imageapi_optimize_webp module for Drupal serves WebP image derivatives with an overly permissive `Cache-Control: public` header for file schemes other than the private file system. This can lead to unauthorized users accessing cached files, especially in environments using shared caches like Varnish or CDNs. The vulnerability is contingent upon specific configurations: the site must serve image derivatives from custom or temporary file schemes with access control, and these must be behind a shared cache that respects the `Cache-Control` header. Access checks remain enforced for requests directly reaching the site, and an attacker would need to know the path of a previously cached file.

Defensive priority

Defenders should prioritize verifying exposure in their Drupal installations that use the imageapi_optimize_webp module, especially if they serve image derivatives from custom or temporary file schemes behind shared caches.

Recommended defensive actions

• Verify if the imageapi_optimize_webp module is installed and enabled in your Drupal setup.
• Check if your Drupal site serves image derivatives from custom or temporary file schemes behind shared caches.
• Update the imageapi_optimize_webp module to version 2.1.2 or later if vulnerable.
• Review cache configurations to ensure proper access controls are in place.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in the imageapi_optimize_webp module versions less than 2.1.2. Official sources include the CVE Program record and the NVD vulnerability detail page. To verify exposure, defenders should check their Drupal installations for the module's presence and review cache configurations. The CVE record and NVD detail provide further information on affected versions and mitigation strategies.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.