Executive brief
Drupal core is the foundational software used to build and manage websites. A vulnerability has been identified where certain code structures, known as a 'gadget chain,' could be used by an attacker to take full control of a site or access its database. However, this issue cannot be exploited on its own; it requires the presence of a second, separate security flaw that allows the processing of untrusted data. Organizations should update to the latest versions of Drupal to remove this potential attack path.
Technical details
Drupal core contains a 'gadget chain'—a sequence of executable code (methods) that can be triggered during the deserialization of PHP objects. While not directly exploitable on its own, this chain provides a vector for an attacker to achieve Remote Code Execution (RCE) or SQL Injection if the application also contains a separate vulnerability that allows passing untrusted input to the PHP unserialize() function. The vulnerability is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). Security updates have been released for Drupal 10 and 11 to mitigate this risk by modifying the affected core methods.
Affected products
- Drupal Drupal core <10.5.12, >=10.6.0 <10.6.11, >=11.2.0 <11.2.14, >=11.3.0 <11.3.12, 11.0.*, 11.1.*
Timeline
- 2026-06-17: advisory: Drupal security advisory SA-CORE-2026-006 published
- 2026-07-10: disclosed: CVE-2026-55804 published to NVD