{"id":"CVE-2019-6340","aliases":["DRUPAL-CORE-2019-003","EUVD-2022-2184","GHSA-3gx6-h57h-rm27"],"status":"published","title":"Drupal core - Highly critical - Remote Code Execution","description":"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.92017,"percentile":0.99822,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2019-02-20T19:18:48Z","modified":"2026-10-24T10:30:34Z","kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-03-25"},{"source":"kev","since":"2022-03-25"}],"exploits":[{"source":"metasploit","id":"exploit/unix/webapp/drupal_restws_unserialize","title":"Drupal RESTful Web Services unserialize() RCE","type":"exploit","platform":"PHP,Unix","date":"2019-02-20","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/webapp/drupal_restws_unserialize"},{"source":"pocgithub","id":"g0rx/Drupal-SA-CORE-2019-003","title":"g0rx/Drupal-SA-CORE-2019-003","date":"2019-02-22","url":"https://github.com/g0rx/Drupal-SA-CORE-2019-003"},{"source":"exploitdb","id":"EDB-46452","title":"Drupal \u003c 8.6.10 / \u003c 8.5.11 - REST Module Remote Code Execution","type":"webapps","platform":"php","date":"2019-02-23","url":"https://www.exploit-db.com/exploits/46452"},{"source":"pocgithub","id":"knqyf263/CVE-2019-6340","title":"knqyf263/CVE-2019-6340","date":"2019-02-23","url":"https://github.com/knqyf263/CVE-2019-6340"},{"source":"pocgithub","id":"DevDungeon/CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass","title":"DevDungeon/CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass","date":"2019-02-25","url":"https://github.com/DevDungeon/CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass"},{"source":"exploitdb","id":"EDB-46459","title":"Drupal \u003c 8.6.9 - REST Module Remote Code Execution","type":"webapps","platform":"php","date":"2019-02-25","url":"https://www.exploit-db.com/exploits/46459"},{"source":"pocgithub","id":"oways/CVE-2019-6340","title":"oways/CVE-2019-6340","date":"2019-02-25","url":"https://github.com/oways/CVE-2019-6340"},{"source":"pocgithub","id":"cved-sources/cve-2019-6340","title":"cved-sources/cve-2019-6340","date":"2019-02-26","url":"https://github.com/cved-sources/cve-2019-6340"},{"source":"exploitdb","id":"EDB-46510","title":"Drupal \u003c 8.5.11 / \u003c 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)","type":"remote","platform":"php","date":"2019-03-07","verified":true,"url":"https://www.exploit-db.com/exploits/46510"},{"source":"pocgithub","id":"josehelps/cve-2019-6340-bits","title":"josehelps/cve-2019-6340-bits","date":"2019-03-12","url":"https://github.com/josehelps/cve-2019-6340-bits"},{"source":"pocgithub","id":"jas502n/CVE-2019-6340","title":"jas502n/CVE-2019-6340","date":"2019-05-27","url":"https://github.com/jas502n/CVE-2019-6340"},{"source":"pocgithub","id":"ludy-dev/drupal8-REST-RCE","title":"ludy-dev/drupal8-REST-RCE","date":"2020-08-31","url":"https://github.com/ludy-dev/drupal8-REST-RCE"},{"source":"pocgithub","id":"nobodyatall648/CVE-2019-6340","title":"nobodyatall648/CVE-2019-6340","date":"2021-05-01","url":"https://github.com/nobodyatall648/CVE-2019-6340"},{"source":"pocgithub","id":"Sumitpathania03/Drupal-cve-2019-6340","title":"Sumitpathania03/Drupal-cve-2019-6340","date":"2023-02-22","url":"https://github.com/Sumitpathania03/Drupal-cve-2019-6340"},{"source":"pocgithub","id":"joaoaugustom/Drupal_REST-RCE_Unauthenticated","title":"joaoaugustom/Drupal_REST-RCE_Unauthenticated","date":"2026-05-27","url":"https://github.com/joaoaugustom/Drupal_REST-RCE_Unauthenticated"},{"source":"nuclei","id":"CVE-2019-6340","title":"Drupal - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6340.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"drupal/core","fixed_in":["8.6.10","7.62.0","8.5.11"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"drupal/drupal","fixed_in":["7.62.0","8.5.11","8.6.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6.0"},{"fixed":"8.6.10"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.62.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.62.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6.0"},{"fixed":"8.6.10"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"8.6.0"},{"fixed":"8.6.10"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6","8.2.7","8.2.8","8.3.0","8.3.0-alpha1","8.3.0-beta1","8.3.0-rc1","8.3.0-rc2","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.3.6","8.3.7","8.3.8","8.3.9","8.4.0","8.4.0-alpha1","8.4.0-beta1","8.4.0-rc1","8.4.0-rc2","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.4.6","8.4.7","8.4.8","8.5.0","8.5.0-alpha1","8.5.0-beta1","8.5.0-rc1","8.5.1","8.5.10","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.5.8","8.5.9","8.6.0","8.6.1","8.6.2","8.6.3","8.6.4","8.6.5","8.6.6","8.6.7","8.6.8","8.6.9"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6.0"},{"fixed":"8.6.10"}]}],"versions":["8.6.0","8.6.1","8.6.2","8.6.3","8.6.4","8.6.5","8.6.6","8.6.7","8.6.8","8.6.9"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.62.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.11"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6","8.2.7","8.2.8","8.3.0","8.3.0-alpha1","8.3.0-beta1","8.3.0-rc1","8.3.0-rc2","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.3.6","8.3.7","8.3.8","8.3.9","8.4.0","8.4.0-alpha1","8.4.0-beta1","8.4.0-rc1","8.4.0-rc2","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.4.6","8.4.7","8.4.8","8.5.0","8.5.0-alpha1","8.5.0-beta1","8.5.0-rc1","8.5.1","8.5.10","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.5.8","8.5.9"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.62.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.11"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6","8.2.7","8.2.8","8.3.0","8.3.0-alpha1","8.3.0-beta1","8.3.0-rc1","8.3.0-rc2","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.3.6","8.3.7","8.3.8","8.3.9","8.4.0","8.4.0-alpha1","8.4.0-beta1","8.4.0-rc1","8.4.0-rc2","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.4.6","8.4.7","8.4.8","8.5.0","8.5.0-alpha1","8.5.0-beta1","8.5.0-rc1","8.5.1","8.5.10","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.5.8","8.5.9"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6.0"},{"fixed":"8.6.10"}]}],"versions":["8.6.0","8.6.1","8.6.2","8.6.3","8.6.4","8.6.5","8.6.6","8.6.7","8.6.8","8.6.9"]}],"products":[{"vendor":"drupal","product":"core"},{"vendor":"drupal","product":"drupal"},{"vendor":"drupal","product":"drupal core"}],"references":[{"url":"https://www.synology.com/security/advisory/Synology_SA_19_09","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.exploit-db.com/exploits/46452/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Patch","Third Party Advisory","VDB Entry","fix"]},{"url":"https://www.drupal.org/sa-core-2019-003","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://www.exploit-db.com/exploits/46510/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://www.securityfocus.com/bid/107106","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.exploit-db.com/exploits/46459/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6340","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6340.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6340.yaml","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/46452","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/46459","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/46510","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3gx6-h57h-rm27"},{"url":"https://github.com/drupal/drupal","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-6340","title":"Drupal core - Highly critical - Remote Code Execution","description":"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)","status":"published","published":"2019-02-21T21:00:00Z","modified":"2025-10-21T23:45:43.2Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:20:23.697579Z"}],"euvd":[{"id":"EUVD-2022-2184","description":"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)","status":"published","published":"2019-02-21T21:00:00Z","modified":"2025-10-21T23:45:43Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-03-25","updated_at":"2026-11-02T20:31:24.172282Z"}],"ghsa":[{"id":"GHSA-3gx6-h57h-rm27","title":"Drupal Core Remote Code Execution Vulnerability","description":"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)","status":"published","published":"2022-05-13T01:22:41Z","modified":"2025-10-22T17:40:42Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2019-6340","title":"Drupal Core Remote Code Execution Vulnerability","description":"In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.","cwes":["CWE-502"],"kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2019-6340","description":"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)","status":"published","published":"2019-02-21T21:29:00.343Z","modified":"2026-06-17T02:39:02.497Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"CVE-2019-6340","description":"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)","status":"published","published":"2019-02-21T21:29:00.343Z","modified":"2026-10-24T10:30:34.560549741Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"GHSA-3gx6-h57h-rm27","title":"Drupal Core Remote Code Execution Vulnerability","description":"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)","status":"published","published":"2022-05-13T01:22:41Z","modified":"2025-12-10T23:41:09.322988Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"DRUPAL-CORE-2019-003","description":"Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.\n\nA site is only affected by this if one of the following conditions is met:\n\n* The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows **GET**, PATCH or POST requests, or\n* the site has another web services module enabled, like [JSON:API](https://www.drupal.org/project/jsonapi) in Drupal 8, or [Services](https://www.drupal.org/project/services) or [RESTful Web Services](https://www.drupal.org/project/restws) in Drupal 7.\n\n(*Note: The Drupal 7 Services module itself does not require an update at this time, but you should still apply other contributed updates associated with this advisory if Services is in use.*)\n\nUpdates\n-------\n\n* **2019-02-22**: Updated risk score given new information; see [PSA-2019-02-22](https://www.drupal.org/psa-2019-02-22). The security risk score has been updated to 23/25 as there are now known exploits in the wild. In addition, any enabled REST resource end-point, **even if it only accepts GET requests**, is also vulnerable. Note this does not include REST exports from Views module.","status":"published","published":"2019-02-20T19:18:48Z","modified":"2026-09-19T19:59:43Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}