As part of Pantheon's Long-Term Support (LTS) for Drupal 7, Drupal 7.106 is now available with a backported security patch.
This release backports the fix for SA-CORE-2026-010, an information disclosure vulnerability in the Image module. Image style derivatives stored on file schemes other than the core private scheme could be served without the access checks intended for access-restricted images.
Action required
Apply the latest upstream update to your Drupal 7 site to receive this fix. See related documentation for how to apply core updates.
About Drupal 7 Long-Term Support
Pantheon has partnered with Tag1 Consulting to deliver security updates and maintenance for Drupal 7 sites. This extended support is included at no additional cost.
For configuration guidance and detailed information, visit our related documentation.