[IT-SecNots] [Security-news] Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-044

Project: Examples for Developers [1]
Date: 2026-June-10
Security risk: *Moderately critical* 11 ∕ 25
AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2]
Vulnerability: Access bypass

Affected versions: <4.0.6
CVE IDs: CVE-2026-11909
Description: 
The Examples for Developers project aims to provide high-quality,
well-documented API examples for a broad range of Drupal core functionality.

The "Read from a file" feature implemented by the file_example submodule can
be used to expose any file that PHP can access. Therefore, the file_example
sub-module is being removed from Examples for Developers until a version
demonstrating file security best practices can be added back in the future.
Developers who based a new module on this example should review their code
for an access bypass.

Solution: 
Any site with the file_example submodule installed should uninstall it
immediately. Then, install the latest version of Examples for Developers:

 * If you are using Examples for Developers 4.0.x, upgrade to Examples for
   Developers 4.0.6 [3]. Developers who based a new module on this example
   should review their code for an access bypass.

Reported By: 
 * Pierre Rudloff (prudloff) [4] of the Drupal Security Team

Fixed By: 
 * Alberto Paderno (avpaderno) [5]
 * Pierre Rudloff (prudloff) [6] of the Drupal Security Team

Coordinated By: 
 * Greg Knaddison (greggles) [7] of the Drupal Security Team
 * Juraj Nemec (poker10) [8] of the Drupal Security Team

Security
issue: https://git.drupalcode.org/security/42-examples-security/-/work_items/1
[9]
------------------------------------------------------------------------------
Contribution record [10]

[1] https://www.drupal.org/project/examples
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/examples/releases/4.0.6
[4] https://www.drupal.org/u/prudloff
[5] https://www.drupal.org/u/avpaderno
[6] https://www.drupal.org/u/prudloff
[7] https://www.drupal.org/u/greggles
[8] https://www.drupal.org/u/poker10
[9] https://git.drupalcode.org/security/42-examples-security/-/work_items/1
[10]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3592370

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at