PHP Object Injection Vulnerability in Drupal Core: Risk of Arbitrary File Inclusion
Summary
DRUPAL-CORE-2025-003: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Arbitrary File Inclusion. Affects drupal/core across 4 version ranges.
>= 8.0.0, < 10.3.13
>= 10.4.0, < 10.4.3
>= 11.0.0, < 11.0.12
>= 11.1.0, < 11.1.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that allows users to create and manage websites easily. It is known for its flexibility, scalability, and a robust ecosystem of modules and themes. However, like any software, Drupal is susceptible to vulnerabilities that can compromise its security. The identified vulnerability in Drupal Core involves a potential PHP Object Injection, which could lead to serious security risks if exploited in conjunction with other vulnerabilities.
Vulnerability Detail
Drupal core contains a potential PHP Object Injection vulnerability that, if combined with another exploit, could lead to Arbitrary File Inclusion. This vulnerability is not directly exploitable on its own; it requires the presence of another vulnerability that allows an attacker to pass unsafe input to the unserialize() function. If successfully exploited, this could escalate to Remote Code Execution, posing a significant threat to the integrity and security of the affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.3.1310.3.13composer require drupal/core:10.3.13 -
>= 10.4.0, < 10.4.310.4.3composer require drupal/core:10.4.3 -
>= 11.0.0, < 11.0.1211.0.12composer require drupal/core:11.0.12 -
>= 11.1.0, < 11.1.311.1.3composer require drupal/core:11.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches by updating to the latest versions of Drupal Core.
Conclusion
The PHP Object Injection vulnerability in Drupal Core poses a significant risk if exploited in conjunction with other vulnerabilities. It is crucial for users to update their installations to the patched versions to ensure the security of their sites. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security measures.
See every vulnerability recorded for drupal/core →
FAQ
PHP Object Injection is a vulnerability that occurs when an application allows untrusted data to be passed to the unserialize() function, potentially leading to the execution of arbitrary code.
If exploited, this vulnerability could allow an attacker to include arbitrary files or execute remote code, compromising the security and integrity of your site.
Versions of Drupal Core between 8.0.0 and 10.3.12, 10.4.0 and 10.4.2, 11.0.0 and 11.0.11, and 11.1.0 and 11.1.2 are affected. Check your version and update accordingly.
While there are no specific workarounds, it is crucial to monitor for any related vulnerabilities and apply updates as soon as possible to mitigate risks.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just the composer.lock file. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
