{"id":"drupal-security-79abc66fcfd4","seq":2013,"kind":"advisory","title":"Drupal core - Critical - PHP object injection - SA-CORE-2026-005","url":"https://www.drupal.org/sa-core-2026-005","permalink":"https://vulnpulse.app/items/drupal-security-79abc66fcfd4","summary":"Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Critical 18 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: PHP object injection Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55803 Description: SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially…","severity":"critical","techs":["drupal","php"],"cves":["CVE-2026-55803"],"tags":["security"],"source":{"id":"drupal-security","name":"Drupal Security Advisories"},"published_at":"2026-06-17T18:56:50.000Z","fetched_at":"2026-10-21T16:17:45.699Z"}