Drupal 7, end of life since 5 January 2025
Drupal 7.103 vulnerabilities
Drupal 7.103 is the last Drupal 7 release. The US National Vulnerability Database lists 5 vulnerabilities for this version, none of them critical. The Drupal Security Team no longer publishes fixes for Drupal 7.
- 5known vulnerabilities
- 0critical
- 0high
- 0exploited in the wild
Is Drupal 7.103 affected?
| Vulnerability | CVE | Drupal 7.103 |
|---|---|---|
| Drupalgeddon 2 | CVE-2018-7600 | Not affected |
For the upstream version, according to the US National Vulnerability Database. A vendor build may differ.
What you can do
Keep Drupal 7.103, patched
We backport the security fixes to Drupal 7 core on your site, tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to Drupal 10 or 11, which usually means rebuilding the site. Our fixes keep it safe in the meantime.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.
All 5 known vulnerabilities in Drupal 7.103
US National Vulnerability Database, 28 October 2026, highest score first. Fixed in: the first upstream release with the fix, where NVD records it. Exploited: listed in the CISA catalogue of known exploited vulnerabilities.
| CVE | Score | Severity | Published | Fixed in | Description |
|---|---|---|---|---|---|
| CVE-2026-55803 | 5.9 | Medium | 2026-07-10 | 10.5.12 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. |
| CVE-2026-55804 | 5.9 | Medium | 2026-07-10 | 10.5.12 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. |
| CVE-2026-55806 | 5.9 | Medium | 2026-07-10 | 10.5.12 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. |
| CVE-2026-55808 | 5.4 | Medium | 2026-07-10 | 10.5.12 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. |
| CVE-2026-55807 | 3.1 | Low | 2026-07-10 | 10.5.12 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. |