CVE-2026-108097: Drupal core, друго

Описание

Оригинално описание

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

Засегнати продукти

• Drupal Drupal core: 8.9.0 преди 10.6.19; 11.0.0 преди 11.3.19; 11.4.0 преди 11.4.10; 12.0.0-alpha1 преди 12.0.0-beta2

Вид слабост

• CWE-470 Избор на класове или код чрез външно контролиран вход

История

Други уязвимости в Drupal Drupal core

• CVE-2026-108515
• CVE-2026-108514
• 4.2CVE-2026-15916
• 4.7CVE-2026-15917
• 5.4CVE-2026-55805

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-108097
• https://nvd.nist.gov/vuln/detail/CVE-2026-108097
• https://www.drupal.org/sa-core-2026-014