CVE-2026-55807

LowCVSS 3.1/10Last modified Oct 25, 2026

Description

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Drupal	Drupal core	>= 0.0.0, < 10.5.12; >= 10.6.0, < 10.6.11; >= 11.2.0, < 11.2.14; >= 11.3.0, < 11.3.12; >= 0.0.0, < 11.0.; >= 0.0.0, < 11.1.

References

https://www.drupal.org/sa-core-2026-008Vendor Advisory

Timeline

Published: Jul 10, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-558085.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site S CVE-2026-558098.1Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object I CVE-2026-55819.1The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and CVE-2026-558108.1Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Inje CVE-2026-558147.5Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes t CVE-2026-55824.3The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to m CVE-2026-558238.7Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around g CVE-2026-558242.6Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external CVE-2026-558253.1Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachmen CVE-2026-558268.7The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, t CVE-2026-558278.8FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec CVE-2026-558286.0qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path val