Drupal core allows Object Injection

MÉDIO 6.6CVE-2026-6366 · BIT-drupal-2026-6366 · DRUPAL-CORE-2026-002 · Published 19/05/2026 · updated 24/07/2026

Em resumo

CVE-2026-6366 é uma vulnerabilidade MÉDIO (CVSS 6.6) que afeta drupal/core, drupal (drupal).
Chance de exploração nos próximos 30 dias (EPSS): 0.40%, maior que 34.2% das vulnerabilidades.
Correção: atualize para 10.6.7, 11.2.11, 11.3.7, 10.5.9 ou posterior.

Package	Affected versions	Patched versions
drupal/core Packagist	`≥ 10.6.0, < 10.6.7≥ 11.0.0, < 11.2.11≥ 11.3.0, < 11.3.7≥ 8.0.0, < 10.5.9`	`10.6.711.2.1111.3.710.5.9`
drupal drupal	`≥ 10.6.0, < 10.6.7≥ 11.0.0, < 11.2.11≥ 11.3.0, < 11.3.7≥ 8.0.0, < 10.5.9`	`10.6.711.2.1111.3.710.5.9`

Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

NVD description

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.