---
id: "CVE-2026-114548"
kind: "vulnerability"
aliases: ["CVE-2026-114548"]
title: "Drupal ImageAPI Optimize WebP: browser cache can expose sensitive images"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:15+00:00"
first_seen_at: "2026-10-30T04:28:37+00:00"
updated_at: "2026-10-30T04:29:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114548", "first_seen_at": "2026-10-30T04:28:37+00:00"}]
---

# Drupal ImageAPI Optimize WebP: browser cache can expose sensitive images

The Drupal ImageAPI Optimize WebP module can leave sensitive content in the web browser cache because of incorrectly configured access controls. An attacker who can use the same browser or cache may be able to read cached image data they should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the ImageAPI Optimize WebP module in the Drupal project (for example with `drush pm:list` or `composer show drupal/imageapi_optimize_webp`).
- Confirm whether the module is enabled on the site.

## Fix

- ImageAPI Optimize WebP: versions from 0.0.0 to 2.1.2 are affected; the sources do not name a fixed version.

## Timeline

- 2026-10-30T04:28:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114548

## From the sources

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_