{
 "slug": "drupal",
 "name": "Drupal",
 "tagline": "Content management system for structured, multilingual websites",
 "category": "cms-ecommerce",
 "use_cases": [
  "cms",
  "websites",
  "content-publishing"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Drupal community / Drupal Association",
  "url": "https://www.drupal.org",
  "license": "GPL-2.0-or-later",
  "license_url": "https://git.drupalcode.org/project/drupal/-/raw/11.3.x/core/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "11.4.11",
   "last_build": "2026-10-23",
   "entity_id": "prod-7pfile4wlhluk",
   "ami_alias": "/aws/service/marketplace/prod-7pfile4wlhluk/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-ps46oovvgscuk",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "11.4.11",
   "last_build": "2026-10-24",
   "offer_id": "drupal",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:drupal:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.drupal?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/drupal/",
  "json": "https://lynxroute.com/products/drupal/product.json"
 },
 "release_notes": [
  {
   "version": "11.4.11",
   "title": "Drupal 11.4.11",
   "notes": "* Drupal core updated 11.4.8 -> 11.4.11. GPL-2.0-or-later unchanged\n* Security (Critical): SA-CORE-2026-014, remote code execution in Field UI (CVE-2026-108097)\n* Security: SA-CORE-2026-015 (Link field XSS, CVE-2026-108515) and SA-CORE-2026-016 (Navigation XSS, CVE-2026-108514)\n* Security: ships the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619; unauthenticated remote code execution in PHP) via Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Earlier images of this product carry the vulnerable PHP and should be replaced\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-10-24"
   }
  },
  {
   "version": "11.4.8",
   "title": "Drupal 11.4.8",
   "notes": "* Drupal 11.4.8 on Ubuntu 24.04 LTS (PHP 8.3 + MariaDB + nginx, Composer install) - bugfix update from 11.4.7 on the 11.4 line. GPL-2.0-or-later unchanged\n* Fixes a Twig 3.30 error that could break page rendering, and a default admin theme issue that could silently unpublish content on save\n* Fixes accidental data loss when a field's \"none\" option disappeared after a value was set, and a memory leak in long-running processes\n* Article and Basic page content types are created on first boot, ready to use\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-02"
   }
  },
  {
   "version": "11.4.7",
   "title": "Drupal 11.4.7",
   "notes": "* Drupal 11.4.7 on Ubuntu 24.04 LTS (PHP 8.3 + MariaDB + nginx, Composer install) - security update from 11.4.6 on the 11.4 line. GPL-2.0-or-later unchanged\n* Security (SA-CORE-2026-013): bundled CKEditor 5 updated to 47.6.3, fixing a cross-site scripting issue that content editors could use against users of the WYSIWYG editor\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-17",
    "azure": "2026-09-18"
   }
  },
  {
   "version": "11.4.6",
   "title": "Drupal 11.4.6",
   "notes": "* Drupal 11.4.6 on Ubuntu 24.04 LTS (PHP 8.3 + MariaDB + nginx, Composer install) - patch update from 11.4.5 on the 11.4 line. GPL-2.0-or-later unchanged\n* Fixes a potential cross-site scripting issue in the block administration script\n* Fixes multiple-cardinality field values not being populated when an entity is loaded, and diff rendering failing on mixed line endings\n* Accessibility fixes: contrast on navigation buttons in dark mode, and accessible names for the colour pickers\n* Resolves PHP 8.5 deprecation warnings\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-06",
    "azure": "2026-09-09"
   }
  },
  {
   "version": "11.4.5",
   "title": "Drupal 11.4.5",
   "notes": "* Drupal 11.4.5 on Ubuntu 24.04 LTS (PHP 8.3 + MariaDB + nginx, Composer install) - minor update from 11.3.16, moving onto the current stable 11.4 line. GPL-2.0-or-later unchanged\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-09-02",
    "azure": "2026-09-03"
   }
  },
  {
   "version": "11.3.16",
   "title": "Drupal 11.3.16 (July 2026)",
   "notes": "* Drupal 11.3.16 on Ubuntu 24.04 LTS (PHP 8.3 + MariaDB + nginx, Composer install) - patch update from 11.3.14. GPL-2.0-or-later unchanged\n* Clears the Composer security warnings raised by third-party components when installing drupal/core-recommended: guzzlehttp/guzzle 7.15.1 and guzzlehttp/psr7 2.12.3\n* Not a Drupal core security release; no database schema or configuration changes\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-23",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "11.3.14",
   "title": "Drupal 11.3.14 (July 2026)",
   "notes": "* Drupal 11.3.14 on Ubuntu 24.04 LTS (PHP 8.3 + MariaDB + nginx, Composer install) - security patch update from 11.3.13\n* Fixes SA-CORE-2026-010 (information disclosure)\n* Fixes SA-CORE-2026-011 and SA-CORE-2026-012 (cross-site scripting)\n* No database schema or configuration changes - standard update only\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-20",
    "azure": "2026-07-20"
   }
  },
  {
   "version": "11.3.12",
   "title": "Drupal 11.3.12 - Initial release (June 2026)",
   "notes": "* Drupal 11.3.12 on Ubuntu 24.04 LTS (PHP 8.3 + MariaDB + nginx, Composer install)\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Site pre-installed at first boot with a unique admin password; unique MariaDB password\n* TLS on port 443; database and PHP-FPM bound to localhost only\n* Update Status beacon disabled (no version phone-home to drupal.org)\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-20"
   }
  }
 ],
 "release_history": [
  {
   "version": "11.4.11",
   "aws": "2026-10-23",
   "azure": "2026-10-24"
  },
  {
   "version": "11.4.8",
   "aws": "2026-10-02",
   "azure": "2026-10-02"
  },
  {
   "version": "11.4.7",
   "aws": "2026-09-17",
   "azure": "2026-09-18"
  },
  {
   "version": "11.4.6",
   "aws": "2026-09-06",
   "azure": "2026-09-09"
  },
  {
   "version": "11.4.5",
   "aws": "2026-09-02",
   "azure": "2026-09-03"
  },
  {
   "version": "11.3.16",
   "aws": "2026-07-23",
   "azure": "2026-07-27"
  },
  {
   "version": "11.3.14",
   "aws": "2026-07-20",
   "azure": "2026-07-20"
  },
  {
   "version": "11.3.13",
   "aws": "2026-07-09"
  },
  {
   "version": "11.3.12",
   "aws": "2026-06-20"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-7pfile4wlhluk/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer drupal --plan payg-gen2\naz vm create -g my-rg -n drupal --size Standard_D2s_v3 \\\n  --image lynxroute:drupal:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Drupal is a leading open-source content management system (CMS) and web application framework used by governments, universities, and enterprises worldwide. It is a PHP application backed by a MySQL/MariaDB or PostgreSQL database and served by nginx with PHP-FPM; this image installs it with Composer (the drupal/recommended-project layout). Drupal gives you structured content types and fields, taxonomy, the Views query builder, flexible URL aliases, a roles-and-permissions access model, revisions and workflows, multilingual content, a theming layer, a REST/JSON:API for headless and decoupled front-ends, and one of the largest module ecosystems of any CMS. Because you self-host it, all content and visitor data stays inside your own AWS account, which makes GDPR and data-residency compliance straightforward. Drupal is GPL-2.0-or-later licensed with no vendor lock-in.",
  "image_adds": "Security hardening:\n* Site pre-installed at first boot with a unique admin password (no install wizard, no shipped default credential)\n* Unique MariaDB password generated at first boot; the database and PHP-FPM bound to 127.0.0.1 only - never exposed to the network\n* TLS enabled on port 443 with a self-signed certificate (replace with your own CA/Let's Encrypt certificate for production)\n* The Update Status beacon is disabled - the image does not phone home to drupal.org for version checks (you can re-enable it under Extend)\n* settings.php locked down and the public files directory isolated; trusted host patterns tracked automatically\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, and AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH key-only access, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nDrupal is a registered trademark of Dries Buytaert. This product is built on the open-source Drupal software and is not affiliated with, endorsed by, or sponsored by the Drupal project or the Drupal Association."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}