Vulnerability advisory
BIT-drupal-2026-6366
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Also known as CVE-2026-6366DRUPAL-CORE-2026-002GHSA-xmjc-63pr-2mpg
Severity
Severity not reported.
Affected versions
drupal Bitnami
| Affected | Fixed in |
|---|---|
8.0.0 to before 10.5.9 | 10.5.9 |
10.6.0 to before 10.6.7 | 10.6.7 |
11.0.0 to before 11.2.11 | 11.2.11 |
11.3.0 to before 11.3.7 | 11.3.7 |
Severity for this package
| |
Description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.
This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.