CVE-2025-13081
Medium · 5.9Drupal core allows Object Injection
CVSS
5.9
EPSS
0.3%
Published
Nov 18, 2025
CISA due date
—
The record
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | drupal/core | 10.5.0 | 10.5.6 |
| Packagist | drupal/core | 11.0.0 | 11.1.9 |
| Packagist | drupal/core | 11.2.0 | 11.2.8 |
| Packagist | drupal/core | 8.0.0 | 10.4.9 |
| Bitnami | drupal | 8.0.0 | 10.4.9 |
| packagist | drupal/core | 10.5.0 | 10.5.6 |
| packagist | drupal/core | 11.0.0 | 11.1.9 |
| packagist | drupal/core | 11.2.0 | 11.2.8 |
| packagist | drupal/core | 8.0.0 | 10.4.9 |
Related vulnerabilities
- GHSA-m6vv-vcj8-w8m7 Drupal core allows Object Injection Same vulnerability
- GHSA-83v7-c2cf-p9c2 Drupal core allows Forceful Browsing Also affects drupal/core
- GHSA-h89p-5896-f4q8 Drupal core allows Content Spoofing Also affects drupal/core
- GHSA-mhpg-hpj5-73r2 Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels Also affects drupal/core
- CVE-2025-13082 Drupal core allows Content Spoofing Also affects drupal/core
- CVE-2025-13083 Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels Also affects drupal/core
- CVE-2025-13080 Drupal core allows Forceful Browsing Also affects drupal/core
- CVE-2024-12393 Drupal Core Cross-Site Scripting (XSS) Also affects drupal/core