CVE-2026-6366: Drupal Core Object Injection Vulnerability
Summary
CVE-2026-6366: Drupal core allows Object Injection. Affects drupal/core across 4 version ranges.
>= 8.0.0, < 10.5.9
>= 10.6.0, < 10.6.7
>= 11.0.0, < 11.2.11
>= 11.3.0, < 11.3.7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2026-6366 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that enables users to create and manage websites easily. It is known for its flexibility, scalability, and a robust ecosystem of modules and themes. However, certain versions of Drupal core are vulnerable to an Object Injection issue, which can lead to unauthorized access and manipulation of object attributes.
Vulnerability Detail
The vulnerability arises from an improperly controlled modification of dynamically-determined object attributes in Drupal core. This flaw allows attackers to inject malicious objects, potentially leading to unauthorized actions or data exposure. The affected versions include Drupal core from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, and from 11.3.0 before 11.3.7. The implications of this vulnerability can be severe, as it may allow attackers to escalate privileges or manipulate sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.5.910.5.9composer require drupal/core:10.5.9 -
>= 10.6.0, < 10.6.710.6.7composer require drupal/core:10.6.7 -
>= 11.0.0, < 11.2.1111.2.11composer require drupal/core:11.2.11 -
>= 11.3.0, < 11.3.711.3.7composer require drupal/core:11.3.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, consider restricting access to the affected components or disabling features that utilize dynamic object attributes until a patch can be applied.
Conclusion
In summary, the Object Injection vulnerability in Drupal core poses significant risks to affected versions. It is crucial for users to update to the latest patched versions to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for drupal/core →
FAQ
It is an Object Injection vulnerability that allows attackers to manipulate object attributes in Drupal core.
Affected versions include Drupal core from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, and from 11.3.0 before 11.3.7.
Attackers may exploit this vulnerability to escalate privileges, manipulate sensitive data, or perform unauthorized actions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 6.6, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
