CVE-2026-6366: Drupal Drupal core Object Injection gadget chain

CVE-2026-6366 · Severity: medium · CVSS 6.6 · Published 2026-05-19

Drupal core contains a 'gadget chain' that could allow an attacker to take full control of a website. This vulnerability is not directly exploitable on its own; it requires the presence of a second, separate flaw that allows the site to process untrusted data. If both conditions are met, an attacker could potentially execute malicious code or access sensitive database information.

Technologies: Drupal, drupal/core (Packagist). Vendors: Drupal, Packagist.

Quick answers

Is CVE-2026-6366 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6366 being exploited in the wild.
How severe is CVE-2026-6366?
Medium severity, with a CVSS score of 6.6, published 19 May 2026.
Which products and versions are affected?
Drupal 8.0.0 to 10.5.8, 10.6.0 to 10.6.6, 11.0.0 to 11.2.10, 11.3.0 to 11.3.6; drupal/core (Packagist) ECOSYSTEM:introduced=8.0.0,fixed=10.5.9, ECOSYSTEM:introduced=8.0.0,fixed=10.5.9|ECOSYSTEM:introduced=10.6.0,fixed=10.6.7|ECOSYSTEM:introduced=11.0.0,fixed=11.2.11|ECOSYSTEM:introduced=11.3.0,fixed=11.3.7.
Is there a fix for CVE-2026-6366?
Yes. drupal/core (Packagist): upgrade to 10.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6366 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-6366?
Check whether you run Drupal or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • drupal/core (Packagist): upgrade to 10.5.9 or later
    composer require drupal/core:^10.5.9

Technical details

Drupal core is vulnerable to PHP Object Injection via a 'gadget chain' (CWE-915). The vulnerability exists in a chain of methods that can be triggered if the application deserializes untrusted data. While not directly exploitable on its own, it serves as a secondary vector that enables Remote Code Execution (RCE) or SQL injection when combined with a primary insecure deserialization flaw. Exploitation requires a high-privileged network attacker and high attack complexity due to the prerequisite of a separate vulnerability. Patches are available in Drupal versions 10.5.9, 10.6.7, 11.2.11, and 11.3.7.

Affected products

  • Drupal Drupal core 8.0.0 to 10.5.8, 10.6.0 to 10.6.6, 11.0.0 to 11.2.10, 11.3.0 to 11.3.6

Identifiers

  • CVE-2026-6366
  • DRUPAL-CORE-2026-002
  • GHSA-xmjc-63pr-2mpg

Timeline

  • 2026-04-15: advisory: Original Drupal security advisory date
  • 2026-05-19: disclosed: NVD publication date
  • 2026-05-20: advisory: GitHub Advisory Database publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.