Is CVE-2026-107312 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107312 being exploited in the wild.

How severe is CVE-2026-107312?

Informational severity, published 30 October 2026.

Which products and versions are affected?

Drupal Examples for Developers before 4.0.7; Packagist:Https://Packages.Drupal.Org/8 Drupal/Examples ECOSYSTEM:introduced=0,fixed=4.0.7.

How is CVE-2026-107312 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107312?

Check whether you run Drupal Examples for Developers or Packagist:Https://Packages.Drupal.Org/8 Drupal/Examples at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107312: Drupal Examples for Developers email_example arbitrary email sending

CVE-2026-107312 · Severity: info · Published 2026-10-30

The Examples for Developers project is a code library providing sample implementations of Drupal functionality. The email_example submodule lacks proper access controls, allowing arbitrary emails to be sent to any address, which could be used for spam or phishing campaigns. The submodule has been removed from the project until security best practices can be demonstrated.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Examples. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-107312 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107312 being exploited in the wild.
How severe is CVE-2026-107312?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Drupal Examples for Developers before 4.0.7; Packagist:Https://Packages.Drupal.Org/8 Drupal/Examples ECOSYSTEM:introduced=0,fixed=4.0.7.
Is there a fix for CVE-2026-107312?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Examples: upgrade to 4.0.7 or later. Until then: Uninstall the email_example submodule immediately from any site where it is installed, then upgrade to Examples for Developers 4.0.7 or later. Developers who based custom modules on this example should review their code for similar security gaps. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107312 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107312?: Check whether you run Drupal Examples for Developers or Packagist:Https://Packages.Drupal.Org/8 Drupal/Examples at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Examples: upgrade to 4.0.7 or later

Uninstall the email_example submodule immediately from any site where it is installed, then upgrade to Examples for Developers 4.0.7 or later. Developers who based custom modules on this example should review their code for similar security gaps.

Technical details

The email_example submodule in Drupal Examples for Developers fails to implement resource limits or proper throttling on email sending functionality, allowing unauthenticated or low-privilege users to send emails to arbitrary recipients. The vulnerability is classified as an allocation of resources without limits. The fix involves upgrading to Examples for Developers 4.0.7 or later and uninstalling the vulnerable email_example submodule immediately.

Affected products

Drupal Examples for Developers before 4.0.7

Identifiers

CVE-2026-107312
DRUPAL-CONTRIB-2026-215

Timeline

2026-10-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.