CVE-2025-31674: Drupal Core Object Injection Vulnerability
Summary
CVE-2025-31674: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.... Affects drupal/core across 4 version ranges.
>= 8.0.0, < 10.3.13
>= 10.4.0, < 10.4.3
>= 11.0.0, < 11.0.12
>= 11.1.0, < 11.1.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2025-31674 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal is a widely-used open-source content management system (CMS) that allows users to create and manage websites easily. It is known for its flexibility, scalability, and a rich ecosystem of modules and themes. However, like any software, it can have vulnerabilities that may expose it to security risks. The vulnerability in question affects various versions of Drupal Core, making it critical for users to stay updated to maintain the security of their applications.
Vulnerability Detail
The vulnerability identified as CVE-2025-31674 is an improperly controlled modification of dynamically-determined object attributes within Drupal Core. This flaw allows for object injection, which can lead to unauthorized access and manipulation of sensitive data. The issue arises from the way Drupal handles object attributes, potentially allowing attackers to exploit this weakness to execute malicious actions within the application. This vulnerability affects multiple versions of Drupal Core, specifically those from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, and from 11.1.0 before 11.1.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.3.1310.3.13composer require drupal/core:10.3.13 -
>= 10.4.0, < 10.4.310.4.3composer require drupal/core:10.4.3 -
>= 11.0.0, < 11.0.1211.0.12composer require drupal/core:11.0.12 -
>= 11.1.0, < 11.1.311.1.3composer require drupal/core:11.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider implementing strict input validation and sanitization for any user inputs that may interact with object attributes. This can help mitigate the risk of exploitation until a proper update can be applied.
Conclusion
The CVE-2025-31674 vulnerability in Drupal Core poses a significant risk due to its potential for object injection. It is crucial for users to update to the latest patched versions to safeguard their applications. Additionally, implementing workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2025-31674 is a vulnerability in Drupal Core that allows for improperly controlled modification of dynamically-determined object attributes, leading to potential object injection.
The vulnerability affects Drupal Core versions from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, and from 11.1.0 before 11.1.3.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
Implement strict input validation and sanitization for user inputs interacting with object attributes as a temporary workaround until you can apply the necessary updates.
Exploitation of this vulnerability can lead to unauthorized access, manipulation of sensitive data, and potential compromise of the entire application.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
