Security advisories: Drupal core – Moderately critical – Improper validation – SA-CORE-2026-009
The JSON:API and REST modules allow you to upload image files to image fields.The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow…














