DRUPAL-CORE-2026-008

At a glance

Published: 2026-06-17 18:57 UTC
Updated: 2026-09-10 03:45 UTC
CVE: CVE-2026-55807
Aliases: BIT-drupal-2026-55807

Description

The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via `providers.json` and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL.

Affected packages

Package	Versions
Packagist · drupal/core	introduced 0, fixed 10.5.12 ; introduced 10.6.0, fixed 10.6.11 ; introduced 11.2.0, fixed 11.2.14 ; introduced 11.3.0, fixed 11.3.12 ; introduced 11.0.0, fixed 11.1.0 ; introduced 11.1.0, fixed 11.2.0

References

https://www.drupal.org/sa-core-2026-008 WEB

Sources

Source	Licence
OSV.dev	See osv.dev/data for this database's licence