Drupal

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. Drupal is a named Tier 1 project, the highest of the two tiers, where the panel grades a merged patch at $500 for a one-liner, $2,000 for a modest improvement, $7,500 for a moderately complex one and $15,000 for a complicated, high-impact change, entirely at its discretion. Patches must be at least one month and no more than twelve months old, maintainers hold a veto, the panel may split the award with them, and sanctions and territory exclusions apply. Latest advisories Loading the feed Overview Drupal runs roughly 0.7% of all websites, and the share understates it badly. Its concentration is in government departments, universities, hospitals and NGOs, the operators who chose it for its granular permission model and who publish the least about their own incidents. A core defect in Drupal has historically been an internet-wide event rather than a per-site one, because the same code sits under tens of thousands of institutional sites that patch on a committee's schedule. Drupal's own security team pays nothing for a report: its HackerOne directory entry records that the external program offers no rewards. sorona.xyz pays you directly on qualified, reproduced findings. In scope The security team takes reports at [email protected] against any supported core release, and nothing narrower than core is carved out. Google's Tier 1 patch row names the same asset, github.com/drupal/drupal The access system in full: node grants, entity access handlers, the permission and role machinery, and every check built on top of them The database layer end to end, covering the abstraction layer, the query builder and anywhere a query is assembled from data an untrusted user controls The render pipeline and Twig templating, where data reaches markup without the escaping the theme layer is supposed to apply File handling as a whole: upload validation, the public and private delivery paths, and any route by which an authenticated low-privilege user reaches PHP execution or arbitrary file write The Form API, CSRF token validation, and the routing and request pipeline that decides which controller runs for which session The user and session subsystem: registration, login, password reset, session handling and account cancellation The REST and JSON:API core modules that expose entity data over HTTP with their own access checks Caching and information flow, covering cache contexts, cache tags, the page and dynamic page caches, and error output that could leak content or configuration to a session that should not see it The update, plugin and configuration-management machinery an administrator drives a running site through Out of scope Contributed modules and themes from drupal.org, which are separate projects with their own maintainers and are not the repository Google's Tier 1 row names Site-specific misconfiguration: a permission an administrator granted, or a role that was set up more broadly than intended PHP itself and other upstream dependencies, which have their own separate pathway rather than being defects in Drupal core One-line fixes for non-exploitable crashes, which the Patch Rewards rules exclude by name along with resource-exhaustion denial of service A patch the maintainers or the security team decline, since the reward panel states it will not second-guess a maintainer's decision Reports that only demonstrate impact with an administrator account already in hand, since a full administrator is inside the trust boundary by design Most-valued findings An access-control bypass in node grants or entity access that lets an unauthenticated or low-privilege visitor read or change content the site gated. That is the largest class in this project's history at 28% and the failure institutional operators chose Drupal to avoid SQL injection reachable without authentication, which on a CMS this widely deployed is a mass-exploitation event rather than a site-specific one Any chain that turns an authenticated low-privilege session into PHP execution on the host, through upload handling, the file system or the plugin and update machinery Stored cross-site scripting in the administrative interface, where the victim is by definition the account with the most authority on the site Information disclosure through routing, cached responses or error output, at 19% a persistent class here and often the first step in a longer chain A structural fix that makes escaping or access checking correct across a whole subsystem rather than at one call site, which is what the Patch Rewards panel grades at the top of its Tier 1 ladder Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report to [email protected] , which is a real and well-run channel and pays nothing for the report itself Send a detailed, reproducible report against a supported core release, naming the version and the roles or permissions the attack starts from Show the bug on core rather than on a contributed module. A contrib finding goes to that module's maintainer and is a different process Give the security team room to ship: Drupal batches core fixes into scheduled security releases and publishes its own advisory, so hold the detail until then If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for a month. That is a separate pathway, rate-limited to three submissions a month, with sanctions and territory exclusions of its own Disclosure Coordinated with the Drupal Security Team, which works to a published release window, ships core fixes on scheduled security-release days and credits reporters in its own advisory. Publication timing follows that window rather than a fixed clock, and sorona.xyz holds your finding until the advisory is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability