# CVE-2026-6366: Drupal Drupal core Object Injection gadget chain

Source: https://junglewise.ai/threats/cve-2026-6366-drupal-drupal-core-object-injection-gadget-chain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-6366 · Severity: medium · CVSS 6.6 · Published 2026-05-19

Drupal core contains a 'gadget chain' that could allow an attacker to take full control of a website. This vulnerability is not directly exploitable on its own; it requires the presence of a second, separate flaw that allows the site to process untrusted data. If both conditions are met, an attacker could potentially execute malicious code or access sensitive database information.

Technologies: [Drupal](https://junglewise.ai/threats/technologies/drupal), [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-6366 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6366 being exploited in the wild.

**How severe is CVE-2026-6366?** Medium severity, with a CVSS score of 6.6, published 19 May 2026.

**Which products and versions are affected?** Drupal 8.0.0 to 10.5.8, 10.6.0 to 10.6.6, 11.0.0 to 11.2.10, 11.3.0 to 11.3.6; drupal/core (Packagist) ECOSYSTEM:introduced=8.0.0,fixed=10.5.9, ECOSYSTEM:introduced=8.0.0,fixed=10.5.9|ECOSYSTEM:introduced=10.6.0,fixed=10.6.7|ECOSYSTEM:introduced=11.0.0,fixed=11.2.11|ECOSYSTEM:introduced=11.3.0,fixed=11.3.7.

**Is there a fix for CVE-2026-6366?** Yes. drupal/core (Packagist): upgrade to 10.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6366 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-6366?** Check whether you run Drupal or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- drupal/core (Packagist): upgrade to 10.5.9 or later

  ```sh
  composer require drupal/core:^10.5.9
  ```


## Technical details

Drupal core is vulnerable to PHP Object Injection via a 'gadget chain' (CWE-915). The vulnerability exists in a chain of methods that can be triggered if the application deserializes untrusted data. While not directly exploitable on its own, it serves as a secondary vector that enables Remote Code Execution (RCE) or SQL injection when combined with a primary insecure deserialization flaw. Exploitation requires a high-privileged network attacker and high attack complexity due to the prerequisite of a separate vulnerability. Patches are available in Drupal versions 10.5.9, 10.6.7, 11.2.11, and 11.3.7.

## Affected products

- Drupal Drupal core 8.0.0 to 10.5.8, 10.6.0 to 10.6.6, 11.0.0 to 11.2.10, 11.3.0 to 11.3.6

## Identifiers

- CVE-2026-6366
- DRUPAL-CORE-2026-002
- GHSA-xmjc-63pr-2mpg

## Timeline

- 2026-04-15: advisory: Original Drupal security advisory date
- 2026-05-19: disclosed: NVD publication date
- 2026-05-20: advisory: GitHub Advisory Database publication date

## References

- [https://www.drupal.org/sa-core-2026-002](https://www.drupal.org/sa-core-2026-002)

## Related threats

- [Drupal core Link module cross-site scripting in markup sanitization](https://junglewise.ai/threats/cve-2026-108515-drupal-core-2026-015-the-drupal-core-link-module-provides-a)
- [Drupal Navigation module cross-site scripting in attributes](https://junglewise.ai/threats/cve-2026-108514-drupal-core-2026-016-the-navigation-module-doesn-t-sufficiently)
- [Drupal Core remote code execution in Field UI module](https://junglewise.ai/threats/cve-2026-108097-drupal-core-2026-014-a-remote-code-execution-vulnerability)
- [Drupal cross-site scripting in CKEditor WYSIWYG](https://junglewise.ai/threats/drupal-core-2026-013-the-drupal-project-uses-the-ckeditor-https-github-f5b3da40)
- [Drupal stored cross-site scripting in Layout Builder](https://junglewise.ai/threats/cve-2026-55805-drupal-stored-cross-site-scripting-in-layout-builder)