{"id":"DRUPAL-CONTRIB-2026-044","aliases":["CVE-2026-11909"],"title":"The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality.","titleSource":"OSV","descriptionSource":"OSV","description":"The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality.\n\nThe \"Read from a file\" feature implemented by the file\\_example submodule can be used to expose any file that PHP can access. Therefore, the file\\_example sub-module is being removed from Examples for Developers until a version demonstrating file security best practices can be added back in the future. Developers who based a new module on this example should review their code for an access bypass.","severity":"unknown","score":null,"published":"2026-06-10T17:07:55.000Z","modified":"2026-09-10T03:45:38.961Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/examples","sources":[{"name":"OSV · DRUPAL-CONTRIB-2026-044","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-044"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.0.6"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<4.0.6"}}],"versions":[],"fixed":["4.0.6"]}],"sourceAffected":[],"references":["https://www.drupal.org/sa-contrib-2026-044"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2026-044","modified":"2026-09-10T03:45:38.961532953Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-044"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T15:50:37.681Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}