{"id":"CVE-2026-108097","aliases":["CLSA-2026-1792527484","CLSA-2026-1792527640","CLSA-2026-1792529137","CLSA-2026-1793031776","DRUPAL-CORE-2026-014","EUVD-2026-113557","GHSA-x75q-mvwp-2h36","ROOT-APP-COMPOSER-CVE-2026-108097"],"status":"published","title":"Drupal core - Critical - Remote code execution - SA-CORE-2026-014","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00572,"percentile":0.47814,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-470"],"published":"2026-10-14T16:10:00Z","modified":"2026-11-06T16:05:59Z","exploits":[{"source":"pocgithub","id":"FurkanKAYAPINAR/CVE-2026-108097","title":"FurkanKAYAPINAR/CVE-2026-108097","date":"2026-10-15","url":"https://github.com/FurkanKAYAPINAR/CVE-2026-108097"},{"source":"pocgithub","id":"fortbridge/cve-2026-108097-research","title":"fortbridge/cve-2026-108097-research","date":"2026-10-18","url":"https://github.com/fortbridge/cve-2026-108097-research"},{"source":"pocgithub","id":"ExDev994/CVE-2026-108097","title":"ExDev994/CVE-2026-108097","date":"2026-10-20","url":"https://github.com/ExDev994/CVE-2026-108097"}],"fixes":[{"ecosystem":"TuxCare:Packagist","package":"drupal/core","fixed_in":["9.5.11-p7+tuxcare"],"sources":["osv"]},{"ecosystem":"Packagist","package":"drupal/core","fixed_in":["10.6.19","11.3.19","11.4.10","12.0.0-beta2"],"sources":["osv"]},{"ecosystem":"Root:Composer","package":"drupal/core","fixed_in":["9.8.0-p12007001+root.io"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.6.17"},{"fixed":"10.6.17-p1+tuxcare"}]}],"versions":["10.6.17"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.5.12"},{"fixed":"10.5.12-p2+tuxcare"}]}],"versions":["10.5.12","10.5.12-p1+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.9.20"},{"fixed":"8.9.20-p8+tuxcare"}]}],"versions":["8.9.20","8.9.20-p1+tuxcare","8.9.20-p2+tuxcare","8.9.20-p3+tuxcare","8.9.20-p4+tuxcare","8.9.20-p5+tuxcare","8.9.20-p6+tuxcare","8.9.20-p7+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.11"},{"fixed":"9.5.11-p7+tuxcare"}]}],"versions":["9.5.11","9.5.11-p1+tuxcare","9.5.11-p2+tuxcare","9.5.11-p3+tuxcare","9.5.11-p4+tuxcare","9.5.11-p5+tuxcare","9.5.11-p6+tuxcare"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.9.0"},{"fixed":"10.6.19"}]},{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.3.19"}]},{"type":"ECOSYSTEM","events":[{"introduced":"11.4.0"},{"fixed":"11.4.10"}]},{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-alpha1"},{"fixed":"12.0.0-beta2"}]}],"versions":["10.0.0","10.0.0-alpha1","10.0.0-alpha2","10.0.0-alpha3","10.0.0-alpha4","10.0.0-alpha5","10.0.0-alpha6","10.0.0-alpha7","10.0.0-beta1","10.0.0-beta2","10.0.0-rc1","10.0.0-rc2","10.0.0-rc3","10.0.1","10.0.10","10.0.11","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","10.1.0","10.1.0-alpha1","10.1.0-beta1","10.1.0-rc1","10.1.1","10.1.2","10.1.3","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.2.0","10.2.0-alpha1","10.2.0-beta1","10.2.0-rc1","10.2.1","10.2.10","10.2.11","10.2.12","10.2.2","10.2.3","10.2.4","10.2.5","10.2.6","10.2.7","10.2.8","10.2.9","10.3.0","10.3.0-beta1","10.3.0-rc1","10.3.1","10.3.10","10.3.11","10.3.12","10.3.13","10.3.14","10.3.2","10.3.3","10.3.4","10.3.5","10.3.6","10.3.7","10.3.8","10.3.9","10.4.0","10.4.0-beta1","10.4.0-rc1","10.4.1","10.4.10","10.4.2","10.4.3","10.4.4","10.4.5","10.4.6","10.4.7","10.4.8","10.4.9","10.5.0","10.5.0-beta1","10.5.0-rc1","10.5.1","10.5.10","10.5.11","10.5.12","10.5.2","10.5.3","10.5.4","10.5.5","10.5.6","10.5.7","10.5.8","10.5.9","10.6.0","10.6.0-beta1","10.6.0-rc1","10.6.1","10.6.10","10.6.11","10.6.12","10.6.13","10.6.14","10.6.15","10.6.16","10.6.17","10.6.18","10.6.2","10.6.3","10.6.4","10.6.5","10.6.6","10.6.7","10.6.8","10.6.9","11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9","11.1.0","11.1.0-beta1","11.1.0-rc1","11.1.1","11.1.10","11.1.2","11.1.3","11.1.4","11.1.5","11.1.6","11.1.7","11.1.8","11.1.9","11.2.0","11.2.0-alpha1","11.2.0-beta1","11.2.0-rc1","11.2.0-rc2","11.2.1","11.2.10","11.2.11","11.2.12","11.2.13","11.2.14","11.2.2","11.2.3","11.2.4","11.2.5","11.2.6","11.2.7","11.2.8","11.2.9","11.3.0","11.3.0-alpha1","11.3.0-beta1","11.3.0-rc1","11.3.0-rc2","11.3.1","11.3.10","11.3.11","11.3.12","11.3.13","11.3.14","11.3.16","11.3.17","11.3.18","11.3.2","11.3.3","11.3.4","11.3.5","11.3.6","11.3.7","11.3.8","11.3.9","11.4.0","11.4.1","11.4.2","11.4.3","11.4.4","11.4.5","11.4.6","11.4.7","11.4.8","11.4.9","12.0.0-alpha1","12.0.0-beta1","8.9.0","8.9.1","8.9.10","8.9.11","8.9.12","8.9.13","8.9.14","8.9.15","8.9.16","8.9.17","8.9.18","8.9.19","8.9.2","8.9.20","8.9.3","8.9.4","8.9.5","8.9.6","8.9.7","8.9.8","8.9.9","9.0.0","9.0.0-alpha1","9.0.0-alpha2","9.0.0-beta1","9.0.0-beta2","9.0.0-beta3","9.0.0-rc1","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9","9.1.0","9.1.0-alpha1","9.1.0-beta1","9.1.0-rc1","9.1.0-rc2","9.1.0-rc3","9.1.1","9.1.10","9.1.11","9.1.12","9.1.13","9.1.14","9.1.15","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7","9.1.8","9.1.9","9.2.0","9.2.0-alpha1","9.2.0-beta1","9.2.0-beta2","9.2.0-beta3","9.2.0-rc1","9.2.1","9.2.10","9.2.11","9.2.12","9.2.13","9.2.14","9.2.15","9.2.16","9.2.17","9.2.18","9.2.19","9.2.2","9.2.20","9.2.21","9.2.3","9.2.4","9.2.5","9.2.6","9.2.7","9.2.8","9.2.9","9.3.0","9.3.0-alpha1","9.3.0-beta1","9.3.0-beta2","9.3.0-beta3","9.3.0-rc1","9.3.1","9.3.10","9.3.11","9.3.12","9.3.13","9.3.14","9.3.15","9.3.16","9.3.17","9.3.18","9.3.19","9.3.2","9.3.20","9.3.21","9.3.22","9.3.3","9.3.4","9.3.5","9.3.6","9.3.7","9.3.8","9.3.9","9.4.0","9.4.0-alpha1","9.4.0-beta1","9.4.0-rc1","9.4.0-rc2","9.4.1","9.4.10","9.4.11","9.4.12","9.4.13","9.4.14","9.4.15","9.4.2","9.4.3","9.4.4","9.4.5","9.4.6","9.4.7","9.4.8","9.4.9","9.5.0","9.5.0-beta1","9.5.0-beta2","9.5.0-rc1","9.5.0-rc2","9.5.1","9.5.10","9.5.11","9.5.2","9.5.3","9.5.4","9.5.5","9.5.6","9.5.7","9.5.8","9.5.9"]},{"source":"osv","ecosystem":"Root:Composer","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.8.0-p12007001+root.io"}]}]}],"products":[{"vendor":"drupal","product":"drupal core"}],"references":[{"url":"https://www.drupal.org/sa-core-2026-014","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108097","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x75q-mvwp-2h36"},{"url":"https://git.drupalcode.org/project/drupal","tags":["web"]},{"url":"https://www.drupal.org/project/drupal","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108097.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-108097","title":"Drupal core - Critical - Remote code execution - SA-CORE-2026-014","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.","status":"published","published":"2026-10-30T03:09:55.043Z","modified":"2026-11-06T16:05:59.537Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-470"],"updated_at":"2026-11-06T17:28:52.192546Z"}],"euvd":[{"id":"EUVD-2026-113557","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.","status":"published","published":"2026-10-30T03:09:55Z","modified":"2026-11-06T16:05:59Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T17:05:29.708432Z"}],"ghsa":[{"id":"GHSA-x75q-mvwp-2h36","title":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability...","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.","status":"published","published":"2026-10-30T06:31:51Z","modified":"2026-11-06T18:34:58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-470"],"updated_at":"2026-11-06T19:01:26.771329Z"}],"nvd":[{"id":"CVE-2026-108097","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.","status":"published","published":"2026-10-30T04:18:04.13Z","modified":"2026-11-06T16:17:36.183Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-470"],"updated_at":"2026-11-06T18:00:55.191747Z"}],"osv":[{"id":"CVE-2026-108097","title":"Drupal core - Critical - Remote code execution - SA-CORE-2026-014","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.","status":"published","published":"2026-10-30T03:09:55.043Z","modified":"2026-11-08T02:30:29.023790986Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-470"],"updated_at":"2026-11-07T03:08:00.155606Z"},{"id":"CLSA-2026-1792527484","title":"TuxCare security update for drupal/core (3 CVEs)","description":"TuxCare rebuilt drupal/core to address 3 CVEs. Fixed in 10.6.17-p1+tuxcare.","status":"published","published":"2026-10-20T20:18:04Z","modified":"2026-10-21T01:30:10.898014369Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792527640","title":"TuxCare security update for drupal/core (3 CVEs)","description":"TuxCare rebuilt drupal/core to address 3 CVEs. Fixed in 10.5.12-p2+tuxcare.","status":"published","published":"2026-10-20T20:20:40Z","modified":"2026-10-21T01:30:11.467298793Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792529137","title":"TuxCare security update for drupal/core (2 CVEs)","description":"TuxCare rebuilt drupal/core to address 2 CVEs. Fixed in 8.9.20-p8+tuxcare.","status":"published","published":"2026-10-20T20:45:37Z","modified":"2026-10-21T01:30:11.471400919Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1793031776","title":"TuxCare security update for drupal/core (1 CVE)","description":"TuxCare rebuilt drupal/core to address 1 CVE. Fixed in 9.5.11-p7+tuxcare.","status":"published","published":"2026-10-26T16:22:56Z","modified":"2026-10-27T01:45:04.42035954Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"DRUPAL-CORE-2026-014","description":"A remote code execution vulnerability exists within the Field UI module in Drupal core.\n\nThe vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may also expose the vulnerable functionality.\n\nThe vulnerability can be mitigated by uninstalling the core Field UI module (`field_ui`), which will provide protection while sites are updated.\n\n#### Drupal Steward protection:\n\nThis issue is being protected by [Drupal Steward](https://www.drupal.org/steward). Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.","status":"published","published":"2026-10-14T16:10:00Z","modified":"2026-10-14T19:09:54Z","updated_at":"2026-11-02T15:46:13.900249Z"},{"id":"ROOT-APP-COMPOSER-CVE-2026-108097","title":"CVE-2026-108097 in drupal/core - Patched by Root","description":"Root has patched CVE-2026-108097 in the drupal/core package for Root:Composer. Multiple fixed versions available.","status":"published","published":"2026-10-28T10:24:20Z","modified":"2026-10-28T11:15:03.723983234Z","updated_at":"2026-11-02T15:53:26.76659Z"}]}}