Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities:

- A PHP object injection vulnerability exists in JSON:API where an attacker with write permissions could inject a malicious payload in certain circumstances when entity reference fields store serialized properties, potentially resulting in PHP object injection. (CVE-2026-55803)

- Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site, which an attacker could leverage to achieve remote code execution or other attacks if the application deserializes untrusted data. (CVE-2026-55804)

- The rebuild.php front controller fails to properly validate the Host header against trusted host patterns, potentially enabling cache poisoning or open redirects to attacker-controlled domains. (CVE-2026-55806)

- The Media module's oEmbed URL discovery mechanism can be exploited to trick Drupal into making server-side requests to arbitrary URLs, resulting in server-side request forgery (SSRF). (CVE-2026-55807)

- The JSON:API and REST modules validate file extensions but not MIME types during image uploads, potentially allowing files to be served with unexpected MIME types and enabling cross-site scripting (XSS) or other unexpected behavior on misconfigured servers. (CVE-2026-55808)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 10.5.x prior to 10.5.12, 10.6.x prior to 10.6.11, 11.2.x prior to 11.2.14, or 11.3.x prior to 11.3.12. It is, therefore, affected by multiple vulnerabilities.

  - Drupal core contains a chain of methods that could be exploitable when an insecure deserialization     vulnerability exists on the site. This so-called gadget chain presents no direct threat, but is a vector     that can be used to achieve remote code execution or SQL injection if the application deserializes     untrusted data due to another vulnerability. This issue is not directly exploitable. This issue is     mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to     allow an attacker to pass unsafe input to unserialize(). (CVE-2026-55804)

  - Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches     and rebuilding the container) when the site is in an unexpected condition.  This script doesn't correctly     check the Host header against the list of trusted host patterns. This could result in cache poisoning or a     redirect to an attacker-controlled domain. (CVE-2026-55806)

  - The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check     the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to     upload a file that is not an image. Certain web-server configurations may serve the uploaded file with its     actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other     unexpected behavior. (CVE-2026-55808)

  - The Media module comes with support for oEmbed. The oEmbed specification contains two discovery     mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick     Drupal into making server-side requests to any URL. (CVE-2026-55807)

  - SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web     services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with     appropriate JSON:API write permission could potentially inject a malicious payload in certain rare     circumstances, potentially resulting in PHP Object Injection. This vulnerability is mitigated by the fact     that in order to be exploitable: A site must use an entity reference field type that stores a serialized     property. An attacker must have permission to write to the entity via JSON:API. No field type shipped with     Drupal core meets these criteria, and contributed or user-created field types that do appear to be     extremely unusual. This update protects all such fields; no changes are required in contributed modules.
    JSON:API is read-only by default, so sites are only affected if they have enabled write access (either     through administrator configuration or the installation of a contributed or custom module that enables     write access). Drupal Steward protection: This issue is being protected by Drupal Steward. In this     instance, we believe that the WAF rule will provide mitigation for the common/obvious vulnerability paths,     but may not cover all cases or work for all hosting providers. Additionally, several other core security     advisories released today are not mitigated by Drupal Steward. Therefore, our recommended action is still     to plan an actual Drupal update within 24 hours of this release. (CVE-2026-55803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
115312	Drupal 10.5.x < 10.5.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
115311	Drupal 10.6.x < 10.6.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
115310	Drupal 11.2.x < 11.2.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
115309	Drupal 11.3.x < 11.3.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
321519	Drupal 10.5.x < 10.5.12 / 10.6.x < 10.6.11 / 11.2.x < 11.2.14 / 11.3.x < 11.3.12 Multiple Vulnerabilities (drupal-2026-06-17)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2026-55803

medium

Tenable Plugins

medium

medium

medium

medium

medium