GHSA-938f-5r4f-h65v

Drupal core contains a potential PHP Object Injection vulnerability

At a glance

Published: 2024-12-10
Updated: 2025-12-10
CVE: CVE-2024-55636
Aliases: BIT-drupal-2024-55636, DRUPAL-CORE-2024-006
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS_V4: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Description

Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Artbitrary File Deletion. It is not directly exploitable. This issue is mitigated by the fact that in order to be exploitable, a separate vulnerability must be present that allows an attacker to pass unsafe input to `unserialize()`. There are no such known exploits in Drupal core. To help protect against this vulnerability, types have been added to properties in some of Drupal core's classes. If an application extends those classes, the same types may need to be specified on the subclass to avoid a `TypeError`. This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Affected packages

Package	Versions
Packagist · drupal/core	introduced 8.8.0, fixed 10.2.11
Packagist · drupal/core	introduced 10.3.0, fixed 10.3.9
Packagist · drupal/core	introduced 11.0.0, fixed 11.0.8
Packagist · drupal/core-recommended	introduced 8.8.0, fixed 10.2.11
Packagist · drupal/core-recommended	introduced 10.3.0, fixed 10.3.9
Packagist · drupal/core-recommended	introduced 11.0.0, fixed 11.0.8
Packagist · drupal/drupal	introduced 8.8.0, fixed 10.2.11
Packagist · drupal/drupal	introduced 10.3.0, fixed 10.3.9
Packagist · drupal/drupal	introduced 11.0.0, fixed 11.0.8

References

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database