GitHub Advisoryadvisory · Packagist
GHSA-xmjc-63pr-2mpg Drupal core allows Object Injection
MEDIUM
Official page ↗
- Aliases
- CVE-2026-6366
- Ecosystem
- Packagist
- Packages
- drupal/core
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-915
- Reviewed
- 2026-06-05
Affected packages
• Packagist drupal/core: >= 8.0.0, < 10.5.9 → fixed in 10.5.9
• Packagist drupal/core: >= 10.6.0, < 10.6.7 → fixed in 10.6.7
• Packagist drupal/core: >= 11.0.0, < 11.2.11 → fixed in 11.2.11
• Packagist drupal/core: >= 11.3.0, < 11.3.7 → fixed in 11.3.7
Description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.
Related
Alias · CVE (1)
- CVE-2026-6366 Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. vulnerability
Weakness · CWE (1)
- CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness