PatchClock

PHP security digest · 7 Oct 2026

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Examp...

Unrated CVE-2026-107312

Package
drupal/examples
Fixed in
4.0.7
Published
Wed 7 Oct 2026, 17:39 LisbonUpdated Mon 26 Oct 2026, 03:27 Lisbon

In plain words

The email_example submodule's Email Example feature can be used to send illegitimate emails to arbitrary email addresses. The submodule is being removed from Examples for Developers until a version demonstrating security best practices can be added.

Am I affected?

Look for drupal/examples and its version in composer.lock. The advisory lists 4.0.7 as fixed but gives no affected version range. Check whether your project uses the email_example submodule's Email Example feature. If you based a new module on this example, review that code too.

What to do

Check which version you have, then update to a fixed release for your branch (4.0.7):

composer show drupal/examples | grep versions
composer update drupal/examples

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

Developers who based a new module on the Email Example should review their code.

The advisory's description

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality.

The "Email Example" feature implemented by the email_example submodule can be used to send illegitimate emails to arbitrary email addresses.

Therefore, the email_example sub-module is being removed from Examples for Developers until a version demonstrating security best practices can be added back in the future. Developers who based a new module on this example should review their code.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.