CVE-2026-55808: Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0., from 0.0.0 to 11.1..
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Patch SA-CORE-2026-009 - Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Fixed in 11.0.* - Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Fixed in 11.1.*
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55808?
CVE-2026-55808 is classified as moderately critical with a risk score of 40.
How do I fix CVE-2026-55808?
To fix CVE-2026-55808, you need to update your Drupal core to a version that addresses this vulnerability.
Which Drupal core versions are affected by CVE-2026-55808?
CVE-2026-55808 affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, and 11.3.0 to 11.3.12.
What type of vulnerability is CVE-2026-55808?
CVE-2026-55808 is an improper validation vulnerability that leads to Cross-Site Scripting (XSS).
What are the potential risks of CVE-2026-55808?
The risk of CVE-2026-55808 includes the potential for attackers to inject malicious scripts into web pages, compromising user data and application integrity.