Security advisories: Drupal core – Moderately critical – Defacement – SA-CORE-2025-007

The defacement is not stored and is only present when the URL has been crafted for that purpose. Only the defacement is present, so no other site content (such as branding) is rendered.By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement.