CVE-2025-31674

score

<0.1

cvss

7.5

epss

0.6%

published

2025-03-31

kev added

—

first seen

2026-10-21

Drupal core from versions 8.0.0 before 10.3.13, 10.4.0 before 10.4.3, 11.0.0 before 11.0.12, and 11.1.0 before 11.1.3 contains an object injection caused by improperly controlled modification of dynamically-determined object attributes, letting attackers execute arbitrary code or cause other malicious effects, exploit requires attacker to control specific object attributes.