SA-CORE-2026-009: XSS
The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.3.12Fixed in 11.2.14Fixed in 10.6.11Fixed in 10.5.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.3.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.2.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.6.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.5.12 - Configuration
Enable or add server-side MIME type validation for image field uploads in the JSON:API and REST modules so uploaded files are checked for an appropriate image MIME type in addition to their file extension before acceptance.
JSON:API and REST modules uploaded_image_mime_validation = validate MIME type in addition to file extension - Configuration
Configure the web server to avoid serving uploaded files with their actual (potentially unsafe) MIME type — for example, force uploaded images to be served with an image Content-Type and/or disable execution of scripts from upload directories to prevent XSS or other unexpected behavior.
web server uploaded_file_serving = force image Content-Type or disable script execution in upload directories
Event History
Frequently Asked Questions
What is the severity of SA-CORE-2026-009?
The severity of SA-CORE-2026-009 is critical with a score of 9.
How do I fix SA-CORE-2026-009?
To fix SA-CORE-2026-009, update your Drupal installation to the latest version as recommended in the security advisory.
What vulnerabilities does SA-CORE-2026-009 introduce?
SA-CORE-2026-009 introduces vulnerabilities related to improper validation of the MIME type for uploaded files, potentially allowing XSS attacks.
Who is affected by SA-CORE-2026-009?
SA-CORE-2026-009 affects all Drupal installations using the JSON:API and REST modules that allow image file uploads.
What are the potential consequences of SA-CORE-2026-009?
The potential consequences of SA-CORE-2026-009 include the possibility of a malicious user uploading non-image files, which could lead to security breaches and exploitation.