Vulnerability Bulletins |
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003 |
|
| Affected software | Drupal |
|
Project: Drupal coreDate: 2025-February-19Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Gadget ChainAffected versions: >= 8.0.0 = 10.4.0 = 11.0.0 = 11.1.0 CVE IDs: CVE-2025-31674Description: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Arbitrary File Inclusion. Techniques exist to escalate this attack to Remote Code Execution. It is not More info: https://www.drupal.org/sa-core-2025-003 |
|