View online: https://www.drupal.org/sa-contrib-2026-044 Project: Examples for Developers [1] Date: 2026-June-10 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <4.0.6 CVE IDs: CVE-2026-11909 Description: The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Read from a file" feature implemented by the file_example submodule can be used to expose any file that PHP can access. Therefore, the file_example sub-module is being removed from Examples for Developers until a version demonstrating file security best practices can be added back in the future. Developers who based a new module on this example should review their code for an access bypass. Solution: Any site with the file_example submodule installed should uninstall it immediately. Then, install the latest version of Examples for Developers: * If you are using Examples for Developers 4.0.x, upgrade to Examples for Developers 4.0.6 [3]. Developers who based a new module on this example should review their code for an access bypass. Reported By: * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By: * Alberto Paderno (avpaderno) [5] * Pierre Rudloff (prudloff) [6] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/42-examples-security/-/work_items/1 [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/examples [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/examples/releases/4.0.6 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/avpaderno [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://git.drupalcode.org/security/42-examples-security/-/work_items/1 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....