CVE-2025-31674: Drupal Core Object Injection Vulnerability
Summary
CVE-2025-31674: Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003. Affects drupal across 2 version ranges.
>= 8.0.0, < 10.4.3
>= 11.0.0, < 11.1.3
Fixed in 10.4.3 or 11.1.3, depending on the release line you run. How to fix ↓
Also tracked for
- drupal/core · Packagist
The same CVE-2025-31674 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that enables users to create and manage websites. It is known for its flexibility, scalability, and extensive community support. However, certain versions of Drupal core are vulnerable to an Object Injection issue, which can lead to unauthorized modifications of dynamically-determined object attributes, potentially compromising the integrity of the application.
Vulnerability Detail
The vulnerability identified as CVE-2025-31674 arises from improperly controlled modifications of dynamically-determined object attributes within Drupal core. This flaw allows for Object Injection, which can be exploited by attackers to manipulate object properties, leading to unauthorized access or modification of sensitive data. The affected versions include Drupal core from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, and from 11.1.0 before 11.1.3. The ramifications of this vulnerability are severe, as it can lead to data breaches and loss of application integrity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.4.310.4.3 -
>= 11.0.0, < 11.1.311.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization measures to mitigate the risk of Object Injection. Additionally, restrict access to sensitive functionalities until the update can be applied.
Conclusion
CVE-2025-31674 is a critical vulnerability affecting multiple versions of Drupal core that can lead to serious security issues through Object Injection. It is crucial for users to update their installations to the latest versions to safeguard their applications.
See every vulnerability recorded for drupal →
FAQ
CVE-2025-31674 is a vulnerability in Drupal core that allows for Object Injection due to improperly controlled modifications of object attributes.
The affected versions include Drupal core from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, and from 11.1.0 before 11.1.3.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and loss of integrity within the application.
The best protection is to update to the latest patched version of Drupal core. Implementing input validation and restricting access to sensitive functionalities can also help mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
