## Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

- 種別: advisory
- 重大度: critical
- 関連技術: drupal, php
- CVE: CVE-2026-55807
- 公開日時: 2026-06-17T18:57:49.000Z
- 情報源: Drupal Security Advisories (https://www.drupal.org/sa-core-2026-008)
- パーマリンク: https://vulnpulse.app/items/drupal-security-4a267b1f627f

Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Server-side request forgery Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55807 Description: The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side request…