CVE-2026-108097
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
| CWE | CWE-470 |
| Vendor | drupal |
| Product | drupal core |
| Ecosystems | |
| Industries | WebMedia |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for drupal drupal core
Be the first to know when new unknown vulnerabilities affecting drupal drupal core are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Drupal / Drupal core
8.9.0 < 10.6.19 11.0.0 < 11.3.19 11.4.0 < 11.4.10 12.0.0-alpha1 < 12.0.0-beta2
Credits
Drew Webber (mcdruid) Octavio Galland (ogalland-tob) catch (catch) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) Jess (xjm) Swan Kalata (akalata) Bram Driesen (bramdriesen) catch (catch) Greg Knaddison (greggles) Tim Hestenes Lehnen (hestenet) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) Juraj Nemec (poker10) Pierre Rudloff (prudloff) Jess (xjm)