EUVD-2026-43084
GHSA-qrwq-jwq3-8cc8
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable SSRF gated on authenticated low-privilege access and specific feature conditions (AC:H); impact confined to low confidentiality via internal resource probing with no integrity or availability consequence.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
5DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
AnalysisAI
Server-Side Request Forgery in Drupal Core allows authenticated low-privilege users to coerce the application server into issuing unauthorized HTTP requests to internal or restricted network destinations. All active 10.6.x and 11.x release branches are affected, along with end-of-life 11.0.x and 11.1.x branches, covering a broad swath of production Drupal deployments. No public exploit code has been identified and EPSS sits at the 3rd percentile, but the large Drupal deployment footprint elevates aggregate exposure even at low per-instance exploitation probability.
Technical ContextAI
Drupal Core (CPE: cpe:2.3:a:drupal:drupal_core:*:*:*:*:*:*:*:*) is a PHP-based content management framework used by millions of sites globally. CWE-918 (Server-Side Request Forgery) describes a class of vulnerability where user-controlled input is incorporated into server-initiated HTTP requests without sufficient origin or destination validation. In this pattern, the server acts as a proxy under attacker direction, potentially reaching internal services such as cloud metadata endpoints (e.g., IMDS), internal APIs, or administrative interfaces that are unreachable from the public internet. The AC:H CVSS metric suggests the vulnerable code path is conditional on a specific Drupal feature, configuration state, or content type being present, rather than being reachable in every default installation. The exact Drupal subsystem - whether in the HTTP client, media handling, feed aggregation, or another component - is not disclosed in the available advisory excerpt.
RemediationAI
Apply the vendor-released patches per Drupal Security Advisory SA-CORE-2026-008 at https://www.drupal.org/sa-core-2026-008. Based on the EUVD affected-version ranges, the patched releases are 10.6.11 for the 10.6.x branch, 11.2.14 for the 11.2.x branch, and 11.3.12 for the 11.3.x branch. The fix version for the legacy 10.5.x branch should be confirmed directly in the advisory, as the NVD and EUVD data present a minor discrepancy on whether 10.5.12 is the last affected or first fixed release. Sites running end-of-life branches (11.0.x, 11.1.x) have no supported patch path and must migrate to a supported branch. If immediate patching is not possible, restrict access to Drupal's administrative and content-authoring interfaces to the minimum required set of authenticated users via network-level controls or Drupal's permission system - note this may affect editorial workflows. Additionally, configure outbound HTTP filtering at the network perimeter to block requests from the web server to internal RFC-1918 address ranges and cloud metadata endpoints (e.g., 169.254.169.254), which limits the blast radius of SSRF without requiring application changes.
More in Drupal Core
View allSQL injection in Drupal core (versions 8.9.0 through the fixed 10.4.10/10.5.10/10.6.9 and 11.x branches through 11.3.10)
Object injection in Drupal Core across branches 8.0.0 through 11.3.x allows a network-accessible, highly privileged auth
Cross-site scripting in Drupal core 11.3.0 through 11.3.6 enables unauthenticated remote attackers to inject malicious s
Cross-site scripting in Drupal Core exposes a broad range of Drupal installations - spanning major versions 8 through 11
Object injection in Drupal Core through improperly controlled modification of dynamically-determined object attributes (
Object injection via a mass assignment flaw in Drupal Core enables an authenticated administrator to manipulate dynamica
Open redirect in Drupal Core across multiple major release branches enables phishing and content spoofing attacks by for
Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute
Cross-site scripting (XSS) in Drupal Core affects a broad swath of the 10.x and 11.x release lines, enabling an authenti
Cross-site scripting in Drupal Core across all maintained 11.x release branches allows network-accessible unauthenticate
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x t
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today