{"id":"drupal-security-556fc1431384","seq":2009,"kind":"advisory","title":"Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009","url":"https://www.drupal.org/sa-core-2026-009","permalink":"https://vulnpulse.app/items/drupal-security-556fc1431384","summary":"Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Improper validation Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55808 Description: The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.…","severity":"critical","techs":["drupal","php"],"cves":["CVE-2026-55808"],"tags":["security"],"source":{"id":"drupal-security","name":"Drupal Security Advisories"},"published_at":"2026-06-17T18:58:02.000Z","fetched_at":"2026-10-21T16:17:45.699Z"}