Drupal up to 10.6.18/11.3.18/11.4.9/12.0.0-beta1 dynamically-managed code resources

Summaryinfo

A vulnerability identified as critical has been detected in Drupal up to 10.6.18/11.3.18/11.4.9/12.0.0-beta1. This affects an unknown function. The manipulation leads to dynamically-managed code resources. This vulnerability is listed as CVE-2026-108097. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Drupal up to 10.6.18/11.3.18/11.4.9/12.0.0-beta1. This issue affects some unknown functionality. The manipulation with an unknown input leads to a dynamically-managed code resources vulnerability. Using CWE to declare the problem leads to CWE-913. The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

It is possible to read the advisory at drupal.org. The identification of this vulnerability is CVE-2026-108097 since 10/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 10.6.19, 11.3.19, 11.4.10 or 12.0.0-beta2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Drupal

Version

• 10.6.0
• 10.6.1
• 10.6.2
• 10.6.3
• 10.6.4
• 10.6.5
• 10.6.6
• 10.6.7
• 10.6.8
• 10.6.9
• 10.6.10
• 10.6.11
• 10.6.12
• 10.6.13
• 10.6.14
• 10.6.15
• 10.6.16
• 10.6.17
• 10.6.18
• 11.3.0
• 11.3.1
• 11.3.2
• 11.3.3
• 11.3.4
• 11.3.5
• 11.3.6
• 11.3.7
• 11.3.8
• 11.3.9
• 11.3.10
• 11.3.11
• 11.3.12
• 11.3.13
• 11.3.14
• 11.3.15
• 11.3.16
• 11.3.17
• 11.3.18
• 11.4.0
• 11.4.1
• 11.4.2
• 11.4.3
• 11.4.4
• 11.4.5
• 11.4.6
• 11.4.7
• 11.4.8
• 11.4.9
• 12.0.0-beta1

License

• open-source

Website

• Product: https://www.drupal.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion