CVE-2025-13081

score

<0.1

cvss

5.9

epss

0.3%

published

2025-11-18

kev added

—

first seen

2026-10-21

Drupal core from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, and from 11.2.0 before 11.2.8 contains an object injection vulnerability caused by improperly controlled modification of dynamically-determined object attributes, letting attackers inject objects remotely, exploit requires crafted input.