# CVE-2026-55804: Drupal core object injection gadget chain

Source: https://junglewise.ai/threats/cve-2026-55804-drupal-core-object-injection-gadget-chain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55804 · Severity: info · CVSS 0 · Published 2026-07-10

Drupal core is the foundational software used to build and manage websites. A vulnerability has been identified where certain code structures, known as a 'gadget chain,' could be used by an attacker to take full control of a site or access its database. However, this issue cannot be exploited on its own; it requires the presence of a second, separate security flaw that allows the processing of untrusted data. Organizations should update to the latest versions of Drupal to remove this potential attack path.

Technologies: [Drupal Core](https://junglewise.ai/threats/technologies/drupal-core), [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-55804 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55804 being exploited in the wild.

**How severe is CVE-2026-55804?** Informational severity, with a CVSS score of 0, published 10 July 2026.

**Which products and versions are affected?** Drupal Core <10.5.12, >=10.6.0 <10.6.11, >=11.2.0 <11.2.14, >=11.3.0 <11.3.12, 11.0.*, 11.1.*; drupal/core (Packagist) ECOSYSTEM:introduced=0,fixed=10.5.12|ECOSYSTEM:introduced=10.6.0,fixed=10.6.11|ECOSYSTEM:introduced=11.2.0,fixed=11.2.14|ECOSYSTEM:introduced=11.3.0,fixed=11.3.12|ECOSYSTEM:introduced=11.0.0,fixed=11.1.0|ECOSYSTEM:introduced=11.1.0,fixed=11.2.0.

**Is there a fix for CVE-2026-55804?** Yes. drupal/core (Packagist): upgrade to 10.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55804 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55804?** Check whether you run Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- drupal/core (Packagist): upgrade to 10.5.12 or later

  ```sh
  composer require drupal/core:^10.5.12
  ```


## Technical details

Drupal core contains a 'gadget chain'—a sequence of executable code (methods) that can be triggered during the deserialization of PHP objects. While not directly exploitable on its own, this chain provides a vector for an attacker to achieve Remote Code Execution (RCE) or SQL Injection if the application also contains a separate vulnerability that allows passing untrusted input to the PHP unserialize() function. The vulnerability is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). Security updates have been released for Drupal 10 and 11 to mitigate this risk by modifying the affected core methods.

## Affected products

- Drupal Drupal core <10.5.12, >=10.6.0 <10.6.11, >=11.2.0 <11.2.14, >=11.3.0 <11.3.12, 11.0.*, 11.1.*

## Identifiers

- CVE-2026-55804
- DRUPAL-CORE-2026-006

## Timeline

- 2026-06-17: advisory: Drupal security advisory SA-CORE-2026-006 published
- 2026-07-10: disclosed: CVE-2026-55804 published to NVD

## References

- [https://www.drupal.org/project/drupal](https://www.drupal.org/project/drupal)
- [https://www.drupal.org/sa-core-2026-006](https://www.drupal.org/sa-core-2026-006)

## Related threats

- [Drupal core Link module cross-site scripting in markup sanitization](https://junglewise.ai/threats/cve-2026-108515-drupal-core-2026-015-the-drupal-core-link-module-provides-a)
- [Drupal Navigation module cross-site scripting in attributes](https://junglewise.ai/threats/cve-2026-108514-drupal-core-2026-016-the-navigation-module-doesn-t-sufficiently)
- [Drupal Core remote code execution in Field UI module](https://junglewise.ai/threats/cve-2026-108097-drupal-core-2026-014-a-remote-code-execution-vulnerability)
- [Drupal cross-site scripting in CKEditor WYSIWYG](https://junglewise.ai/threats/drupal-core-2026-013-the-drupal-project-uses-the-ckeditor-https-github-f5b3da40)
- [Drupal stored cross-site scripting in Layout Builder](https://junglewise.ai/threats/cve-2026-55805-drupal-stored-cross-site-scripting-in-layout-builder)