{"id":"DRUPAL-CONTRIB-2026-044","details":"The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality.\n\nThe \"Read from a file\" feature implemented by the file\\_example submodule can be used to expose any file that PHP can access. Therefore, the file\\_example sub-module is being removed from Examples for Developers until a version demonstrating file security best practices can be added back in the future. Developers who based a new module on this example should review their code for an access bypass.","aliases":["CVE-2026-11909"],"modified":"2026-09-10T03:45:38.961532953Z","published":"2026-06-10T17:07:55Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-044"}],"affected":[{"package":{"name":"drupal/examples","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/examples?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6"}],"database_specific":{"constraint":"\u003c4.0.6"}}],"database_specific":{"affected_versions":"\u003c4.0.6","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/examples/DRUPAL-CONTRIB-2026-044.json"}}],"schema_version":"1.9.0","credits":[{"name":"Pierre Rudloff (prudloff)","contact":["https://www.drupal.org/u/prudloff"]}]}