CVE-2026-6366
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. Affects versions from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, and from 11.3.0 before 11.3.7.
Risk Assessment
An attacker can remotely execute malicious code, potentially leading to full compromise of the Drupal system.
Recommendation
Update Drupal core to version 10.5.9, 10.6.7, 11.2.11, or 11.3.7.
Original NVD description (English source)
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.