Atelier Atelier by AIncient Labs

Security · Critical ·

Drupal core and PHP remote code execution

Atelier 0.19.1 updates Drupal core, PHP and two dependencies to fix critical remote code execution flaws.

ATELIER-SA-2026-001 ·

Severity
Critical
Affected
Atelier < 0.19.1
Fixed in
Atelier 0.19.1
References
SA-CORE-2026-014, SA-CORE-2026-015, SA-CORE-2026-016, CVE-2026-109618, CVE-2026-109619, SA-CONTRIB-2026-252, CVE-2026-109449

Every Atelier release before 0.19.1 ships with components that have published security flaws. Two of them let an attacker run code on the server. Update to 0.19.1 now.

What is fixed

  • Drupal core 11.4.11. Fixes a critical remote code execution flaw (SA-CORE-2026-014) and two cross-site scripting flaws (SA-CORE-2026-015, SA-CORE-2026-016).
  • PHP 8.4.27. Fixes the PHP2Shell remote code execution flaws (CVE-2026-109618, CVE-2026-109619). The Atelier image now refuses to build on an older PHP.
  • Rabbit Hole 1.3.0. Fixes an access bypass (SA-CONTRIB-2026-252).
  • Symfony expression parser 8.1.9. Fixes a crash caused by deeply nested expressions (CVE-2026-109449).

What to do

Run atelier app update, or re-run the installer as described in Upgrade. Either one pulls the 0.19.1 image and upgrades your site in place.