SA-CONTRIB-2026-215: Critical severity drupal/examples vulnerability
The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Example" feature implemented by the emailexample submodule can be used to send illegitimate emails to arbitrary email addresses. Therefore, the emailexample sub-module is being removed from Examples for Developers until a version demonstrating security best practices can be added back in the future. Developers who based a new module on this example should review their code.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/examplesto a version that resolves this vulnerability.Fixed in 4.0.7 - Remove
Remove
Examples for Developers email_example submodulefrom your environment.Remove the email_example submodule, which can send illegitimate emails to arbitrary email addresses.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the email_example submodule in the Drupal Examples for Developers project are exposed. Developers who used that example as the basis for a new module should also review their derived code.
What does an attacker need to exploit it?
The available information states that the email_example feature can be used to send illegitimate emails to arbitrary addresses. It does not specify the access level, input path, or other prerequisites required to trigger it.
What should be done if the affected feature is installed?
Remove or disable the email_example submodule. Review any custom modules based on its code and correct any similar email-sending behavior.
How can I determine whether my site is affected?
Check whether the email_example submodule from Drupal Examples for Developers is installed or enabled. Also identify custom modules whose implementation was copied or adapted from the Email Example.