{"id":"drupal-security-4a267b1f627f","seq":2010,"kind":"advisory","title":"Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008","url":"https://www.drupal.org/sa-core-2026-008","permalink":"https://vulnpulse.app/items/drupal-security-4a267b1f627f","summary":"Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Server-side request forgery Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55807 Description: The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side request…","severity":"critical","techs":["drupal","php"],"cves":["CVE-2026-55807"],"tags":["security"],"source":{"id":"drupal-security","name":"Drupal Security Advisories"},"published_at":"2026-06-17T18:57:49.000Z","fetched_at":"2026-10-21T16:17:45.699Z"}