{"id":"drupal-security-e1e1f455c672","seq":2028,"kind":"advisory","title":"Drupal core - Less critical - Gadget chain - SA-CORE-2024-006","url":"https://www.drupal.org/sa-core-2024-006","permalink":"https://vulnpulse.app/items/drupal-security-e1e1f455c672","summary":"Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Less critical 8 ∕ 25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: >= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8 CVE IDs: CVE-2024-55636 Description: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Artbitrary File Deletion. It is not directly exploitable. This issue is mitigated by the fact that in order to be exploitable, a separate vulnerability must be p…","severity":"critical","techs":["drupal","php"],"cves":["CVE-2024-55636"],"tags":["security"],"source":{"id":"drupal-security","name":"Drupal Security Advisories"},"published_at":"2024-11-20T17:25:47.000Z","fetched_at":"2026-10-21T16:17:45.699Z"}