CVE-2024-55638

score

<0.1

cvss

9.8

epss

1.0%

published

2024-12-10

kev added

—

first seen

2026-10-21

Drupal Core from versions 7.0 before 7.102 and 8.0.0 before 10.2.11, 10.3.0 before 10.3.9 contains an object injection caused by insecure deserialization in a chain of methods, letting attackers potentially achieve remote code execution if untrusted data is deserialized, exploit requires deserialization of untrusted data.