CVE-2026-55808: Drupal Core Image Upload Vulnerability Leading to Potential XSS
Summary
CVE-2026-55808: The JSON:API and REST modules allow you to upload image files to image fields. Affects drupal/core across 6 version ranges.
< 10.5.12
>= 10.6.0, < 10.6.11
>= 11.0.0, < 11.1.0
>= 11.1.0, < 11.2.0
>= 11.2.0, < 11.2.14
>= 11.3.0, < 11.3.12
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2026-55808 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely used open-source content management system (CMS) that allows users to create and manage websites easily. It offers a variety of modules, including JSON:API and REST, which enable developers to build APIs for their applications. However, these modules have a vulnerability related to file uploads, specifically image files, which could be exploited if not addressed.
Vulnerability Detail
The vulnerability arises from the JSON:API and REST modules' inadequate validation of uploaded image files. While the modules check the file extension, they do not verify the file's MIME type. This oversight allows malicious users to upload non-image files disguised as images. If the web server is configured to serve these files with their actual MIME type, it could lead to cross-site scripting (XSS) attacks or other unexpected behaviors, compromising the security of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 10.5.1210.5.12composer require drupal/core:10.5.12 -
>= 10.6.0, < 10.6.1110.6.11composer require drupal/core:10.6.11 -
>= 11.0.0, < 11.1.011.1.0composer require drupal/core:11.1.0 -
>= 11.1.0, < 11.2.011.2.0composer require drupal/core:11.2.0 -
>= 11.2.0, < 11.2.1411.2.14composer require drupal/core:11.2.14 -
>= 11.3.0, < 11.3.1211.3.12composer require drupal/core:11.3.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your web server is configured to restrict access to uploaded files, or implement additional validation checks on the server-side to verify the MIME type of uploaded files before processing them.
Conclusion
The CVE-2026-55808 vulnerability in Drupal Core poses a significant risk due to inadequate validation of uploaded image files. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2026-55808 is a vulnerability in Drupal Core that allows malicious users to upload non-image files through the JSON:API and REST modules, potentially leading to XSS attacks.
If you are using Drupal versions prior to 10.5.12, between 10.6.0 and 10.6.11, between 11.2.0 and 11.2.14, or between 11.3.0 and 11.3.12, your installation is vulnerable.
If immediate updates are not possible, implement server-side validation to check the MIME type of uploaded files and restrict access to uploaded files on your web server.
More details can be found in the official Drupal security advisory or on the CVE database for CVE-2026-55808.
Vulert monitors and alerts you in real-time for open-source vulnerabilities in your software using just the composer.lock file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
