Entity Share Websub security updates, in plain English

Entity Share Websub

498 sites report using it · on drupal.org · 1 security update explained here

This module automatically copies content from one website to another.

Below is every security update for Entity Share Websub that this site has covered, newest first. Each one says who could exploit it, whether it applies to your site, how urgent it is, and what to tell your developer. If your site uses this module and you are not sure which version, that is the first question to ask whoever looks after it.

Entity Share Websub

Moderately critical · 498 sites report using it · SA-CONTRIB-2026-097 · on drupal.org · Week of 12 August 2026

A visitor could force the website server to make requests to other web addresses. This might allow them to see information from other servers that the website connects to. They could not change or delete any information on the website itself.

Who could do thisAnyone visiting the site. No login needed.
Does it apply to youAny site using this module.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Entity Share Websub to 1.1.2.

For developers: what the fix changed

The fix introduces a `CallbackValidator` service to validate WebSub callback URLs against internal and reserved IP ranges, preventing SSRF attacks. This validation is applied in `Hub.php` before making requests and in `Subscription.php` during subscription creation, with exceptions configurable via a new `CallbackValidatorSettingsForm`.

Also in this release The release also updates core version requirements to include Drupal 11, modifies GitLab CI templates, adds subscription deletion events, and updates logger dependency injection.

1.1.1 to 1.1.2 17 commits, 39 files including 10 tests.

.cspell-project-words.txt +7 −0
.gitlab-ci.yml +16 −0
README.md +29 −0
entity_share_websub.info.yml +1 −1
modules/entity_share_websub_hub/config/install/entity_share_websub_hub.settings.yml +2 −0 fix
modules/entity_share_websub_hub/config/schema/entity_share_websub_hub.schema.yml +16 −0 fix
modules/entity_share_websub_hub/entity_share_websub_hub.info.yml +1 −1
modules/entity_share_websub_hub/entity_share_websub_hub.install +117 −0 fix
modules/entity_share_websub_hub/entity_share_websub_hub.links.menu.yml +5 −0 fix
modules/entity_share_websub_hub/entity_share_websub_hub.permissions.yml +5 −0 fix
modules/entity_share_websub_hub/entity_share_websub_hub.post_update.php +42 −0 fix
modules/entity_share_websub_hub/entity_share_websub_hub.routing.yml +11 −0 fix

Full diff, 1.1.1 to 1.1.2

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Get in touch

Tell me who you are, what your organisation does, and what you need. That might be a Drupal site that needs looking after, an upgrade to get done before December, or an agency that needs Drupal cover.

If I can help, I'll say so and suggest a call. If I can't, I'll tell you straight away rather than waste your time.

For context: I work mainly with UK charities, membership bodies and research organisations, and with the agencies that look after their websites. Not recruiters.

Or start smaller and connect with me on LinkedIn. That's where I post what I find digging around in charity and grants data, and where the free tools turn up first.

Entity Share Websub

Entity Share Websub

Send me your Drupal site's address.

Get in touch

Links

Reference