CVE-2026-55804: Drupal core object injection gadget chain

CVE-2026-55804 · Severity: info · CVSS 0 · Published 2026-07-10

Drupal core is the foundational software used to build and manage websites. A vulnerability has been identified where certain code structures, known as a 'gadget chain,' could be used by an attacker to take full control of a site or access its database. However, this issue cannot be exploited on its own; it requires the presence of a second, separate security flaw that allows the processing of untrusted data. Organizations should update to the latest versions of Drupal to remove this potential attack path.

Technologies: Drupal Core, drupal/core (Packagist). Vendors: Drupal, Packagist.

Quick answers

Is CVE-2026-55804 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55804 being exploited in the wild.
How severe is CVE-2026-55804?
Informational severity, with a CVSS score of 0, published 10 July 2026.
Which products and versions are affected?
Drupal Core <10.5.12, >=10.6.0 <10.6.11, >=11.2.0 <11.2.14, >=11.3.0 <11.3.12, 11.0.*, 11.1.*; drupal/core (Packagist) ECOSYSTEM:introduced=0,fixed=10.5.12|ECOSYSTEM:introduced=10.6.0,fixed=10.6.11|ECOSYSTEM:introduced=11.2.0,fixed=11.2.14|ECOSYSTEM:introduced=11.3.0,fixed=11.3.12|ECOSYSTEM:introduced=11.0.0,fixed=11.1.0|ECOSYSTEM:introduced=11.1.0,fixed=11.2.0.
Is there a fix for CVE-2026-55804?
Yes. drupal/core (Packagist): upgrade to 10.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55804 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55804?
Check whether you run Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • drupal/core (Packagist): upgrade to 10.5.12 or later
    composer require drupal/core:^10.5.12

Technical details

Drupal core contains a 'gadget chain'—a sequence of executable code (methods) that can be triggered during the deserialization of PHP objects. While not directly exploitable on its own, this chain provides a vector for an attacker to achieve Remote Code Execution (RCE) or SQL Injection if the application also contains a separate vulnerability that allows passing untrusted input to the PHP unserialize() function. The vulnerability is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). Security updates have been released for Drupal 10 and 11 to mitigate this risk by modifying the affected core methods.

Affected products

  • Drupal Drupal core <10.5.12, >=10.6.0 <10.6.11, >=11.2.0 <11.2.14, >=11.3.0 <11.3.12, 11.0.*, 11.1.*

Identifiers

  • CVE-2026-55804
  • DRUPAL-CORE-2026-006

Timeline

  • 2026-06-17: advisory: Drupal security advisory SA-CORE-2026-006 published
  • 2026-07-10: disclosed: CVE-2026-55804 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.