{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-55808","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-55808\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-55808\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3060","id":"3060","resource":"node"},"field_sa_advisory_id":"009","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/damienmckenna\u0022 rel=\u0022nofollow\u0022\u003EDamien McKenna (damienmckenna)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/larowlan\u0022 rel=\u0022nofollow\u0022\u003ELee Rowlands (larowlan)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/longwave\u0022 rel=\u0022nofollow\u0022\u003EDave Long (longwave)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/xjm\u0022 rel=\u0022nofollow\u0022\u003EJess  (xjm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Complex\/A:User\/CI:Some\/II:Some\/E:Theoretical\/TD:Uncommon","field_sa_description":{"value":"\u003Cp\u003EThe JSON:API and REST modules allow you to upload image files to image fields.\u003C\/p\u003E\n\u003Cp\u003EThe validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.\u003C\/p\u003E\n\u003Cp\u003ECertain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/bbrala\u0022 rel=\u0022nofollow\u0022\u003EBj\u00f6rn Brala (bbrala)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/kimpepper\u0022 rel=\u0022nofollow\u0022\u003EKim Pepper (kim.pepper)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/larowlan\u0022 rel=\u0022nofollow\u0022\u003ELee Rowlands (larowlan)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/cantina_security\u0022 rel=\u0022nofollow\u0022\u003Ecantina_security\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cp\u003E\u003Cstrong\u003EDrupal 11\u003C\/strong\u003E\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use Drupal 11.3.x, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/11.3.12\u0022 rel=\u0022nofollow\u0022\u003EDrupal 11.3.12\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EIf you use Drupal 11.2.x, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/11.2.14\u0022 rel=\u0022nofollow\u0022\u003EDrupal 11.2.14\u003C\/a\u003E.\u003C\/li\u003E\n\u003C\/ul\u003E\n\u003Cp\u003E\u003Cstrong\u003EDrupal 10\u003C\/strong\u003E\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use Drupal 10.6.x, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/10.6.11\u0022 rel=\u0022nofollow\u0022\u003EDrupal 10.6.11\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EIf you use Drupal 10.5.x, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/10.5.12\u0022 rel=\u0022nofollow\u0022\u003EDrupal 10.5.12\u003C\/a\u003E.\u003C\/li\u003E\n\u003C\/ul\u003E\n\u003Cp\u003EDrupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (\u003Ca href=\u0022https:\/\/www.drupal.org\/psa-2021-06-29\u0022 rel=\u0022nofollow\u0022\u003EDrupal 8\u003C\/a\u003E and \u003Ca href=\u0022https:\/\/www.drupal.org\/psa-2023-11-01\u0022 rel=\u0022nofollow\u0022\u003EDrupal 9\u003C\/a\u003E have both reached end-of-life.)\u003C\/p\u003E","format":"1"},"field_sa_type":"Improper validation","field_issue_last_status_change":"1781722682","field_sa_cve":["CVE-2026-55808"],"field_is_psa":"0","field_affected_versions":"\u003C10.5.12 || \u003E=10.6.0 \u003C10.6.11 || \u003E=11.2.0 \u003C11.2.14 || \u003E=11.3.0 \u003C11.3.12 || 11.0.* || 11.1.*","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3603249","id":"3603249","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3603252","id":"3603252","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3603331","id":"3603331","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3603400","id":"3603400","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3603411","id":"3603411","resource":"node"}],"nid":"3593385","vid":"14396916","is_new":false,"type":"sa","title":"Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009","language":"en","url":"https:\/\/www.drupal.org\/sa-core-2026-009","edit_url":"https:\/\/www.drupal.org\/node\/3593385\/edit","status":"1","promote":"0","sticky":"0","created":"1781722682","changed":"1781722682","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16638213","id":16638213,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16638249","id":16638249,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16638250","id":16638250,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16638251","id":16638251,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16638252","id":16638252,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16638253","id":16638253,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16638254","id":16638254,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16641386","id":16641386,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16641387","id":16641387,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1781722682"}]}