Drupal Theme Negotiation by Rules 存在跨站请求伪造 (CSRF) 漏洞，允许跨站请求伪造。此问题影响 Theme Negotiation by Rules: 从 0.0.0 之前到 1.2.1。

The CSRF vulnerability in Drupal Theme Negotiation by Rules allows an attacker to craft malicious requests that appear to originate from a legitimate user. If successful, an attacker could modify theme negotiation rules, potentially altering how the site renders content or redirects users. This could lead to defacement, redirection to malicious websites, or even the execution of arbitrary code if the theme negotiation rules are exploited in conjunction with other vulnerabilities. The blast radius extends to any user with access to the administrative interface, as their actions could be hijacked.

Drupal sites utilizing the Theme Negotiation by Rules module, particularly those running versions prior to 1.2.1, are at risk. Sites with less stringent security practices or those that haven't implemented CSRF protection mechanisms are particularly vulnerable.

• drupal:

find /var/www/html -name 'theme_negotiation_by_rules.module' -print0 | xargs -0 grep -i 'DRUPAL_CORE_VERSION' 

• generic web:

curl -I https://your-drupal-site.com/ | grep -i 'content-type'

1. 2026-03-25Disclosure

   disclosure

1. 已保留2026-02-25
2. 发布日期2026-03-25
3. 修改日期2026-03-31
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2026-3211 is to immediately upgrade Drupal Theme Negotiation by Rules to version 1.2.1 or later. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding on all user-supplied data used in theme negotiation rules. Implementing a CSRF protection mechanism, such as a token system, can also help mitigate the risk. After upgrading, confirm the fix by attempting to submit a malicious request and verifying that it is blocked.