CVE-2025-3057
Project: Drupal core Date: 2025-February-19 Security risk: Critical 17 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Proof/TD:All Vulnerability: Cross site scripting Affected versions: >= 8.0.0 < 10.3.13 || >= 10.4.0 < 10.4.3 || >= 11.0.0 < 11.0.12 || >= 11.1.0 < 11.1.3 CVE IDs: CVE-2025-3057 Description: Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability (XSS). Sites are encouraged to update. There are not yet public documented steps to exploit this, but there may be soon given the nature of this issue. This issue is being protected by Drupal Steward . Sites that use Drupal Steward are already protected, but are still encouraged to upgrade in the near future. Solution: Install the latest version: If you use Drupal 10.3.x, update to Drupal 10.3.13 If you use Drupal 10.4.x, update to Drupal 10.4.3 If you use Drupal 11.0.x, update to Drupal 11.0.12 If you use Drupal 11.1.x, update to Drupal 11.1.3 All versions of Drupal 10 prior to 10.3 are end-of-life and do not receive security coverage. ( Drupal 8 and Drupal 9 have both reached end-of-life.) Reported By: Arne (arkepp) bdanin Douglas Groene (dgroene) Dragos Dumitrescu (dragos-dumi) Flo Kosiol (flokosiol) Gerardo Cadau (juanramonperez) Justin Christoffersen (larsdesigns) nuwans Sven Decabooter (svendecabooter) Will Gunn (wgunn_e) Fixed By: catch (catch) of the Drupal Security Team Drew Webber (mcdruid) of the Drupal Security Team
CSIRTS triage
- What
- Insufficient filtering of error messages leads to a reflected Cross Site Scripting vulnerability.
- Who is affected
- Drupal installations using affected versions.
- Urgency
- Remediation is critical as it poses a risk of XSS attacks.
- Action
- Update to the latest version of Drupal.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2025-3057
Get an email if CVE-2025-3057 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
Advisory coverage (1)
- criticalDrupal core - Critical - Cross site scripting - SA-CORE-2025-001drupal · 2025-02-19
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2025-3057)