🔐 CVE Alert

CVE-2026-12535

CRITICAL 9.8

Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048

CVSS Score
9.8
EPSS Score
0.2%
EPSS Percentile
7th

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.

CWE CWE-915
Vendor drupal
Product formatter field
Ecosystems
Industries
WebMedia
Published Jul 10, 2026
Last Updated Jul 13, 2026
Stay Ahead of the Next One

Get instant alerts for drupal formatter field

Be the first to know when new critical vulnerabilities affecting drupal formatter field are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Drupal / Formatter Field
0.0.0 < 2.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
drupal.org: https://www.drupal.org/sa-contrib-2026-048

Credits

Drew Webber (mcdruid) Kostia Bohach (_shy) Benji Fisher (benjifisher) Drew Webber (mcdruid) Jess (xjm)