CVE-2026-55807
Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
CVSS Score
3.1
EPSS Score
0.1%
EPSS Percentile
3th
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
| CWE | CWE-918 |
| Vendor | drupal |
| Product | drupal core |
| Ecosystems | |
| Industries | WebMedia |
| Published | Jul 10, 2026 |
| Last Updated | Jul 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for drupal drupal core
Be the first to know when new low vulnerabilities affecting drupal drupal core are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Drupal / Drupal core
0.0.0 < 10.5.12 10.6.0 < 10.6.11 11.2.0 < 11.2.14 11.3.0 < 11.3.12 0.0.0 < 11.0.* 0.0.0 < 11.1.*
Credits
Hamed Kohi (0xhamy) assaf alassaf (ama62) Albert Skibinski (askibinski) Jon Minder (ayalon) Lautaro Casanova (betah4k) Gabe Sullice (gabesullice) John Morahan (john morahan) Michael Winser (michaelwinser) nbanderson offensive-ai Francesco Placella (plach) quynh ho (qquynh) Himanshu Anand (unknownhad) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) Adam G-H (phenaproxima) Sean Blommaert (seanb) Benji Fisher (benjifisher) cilefen (cilefen) Damien McKenna (damienmckenna) Mori Sugimoto (dokumori) Greg Knaddison (greggles) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) James Gilliland (neclimdul) Juraj Nemec (poker10) Jess (xjm)