DRUPAL-CONTRIB-2018-001
This module enables content editors to create complex pages and layouts on the fly without the help from a developer, using reusable widgets.
The module does not sufficiently filter values posted to its AJAX endpoint, which leads to the instantiation of an arbitrary PHP class.
This vulnerability is mitigated by the fact that only sites with the Stacks - Content Feed submodule enabled are affected.
What each source reports
OSV No score
This module enables content editors to create complex pages and layouts on the fly without the help from a developer, using reusable widgets.
The module does not sufficiently filter values posted to its AJAX endpoint, which leads to the instantiation of an arbitrary PHP class.
This vulnerability is mitigated by the fact that only sites with the Stacks - Content Feed submodule enabled are affected.
- Record
DRUPAL-CONTRIB-2018-001- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/stacksPackagist:https://packages.drupal.org/8 |
before 1.1.0 | 1.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2018-001 is a vulnerability with no CVSS score yet in drupal/stacks, published January 10, 2018. No source lists public exploit code. Fixed in drupal/stacks 1.1.0.