## Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

- 種別: advisory
- 重大度: critical
- 関連技術: drupal, php
- CVE: CVE-2025-31674
- 公開日時: 2025-02-19T17:03:28.000Z
- 情報源: Drupal Security Advisories (https://www.drupal.org/sa-core-2025-003)
- パーマリンク: https://vulnpulse.app/items/drupal-security-f36388c77757

Project: Drupal core Project machine name: drupal Date: 2025-February-19 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget Chain Affected versions: >= 8.0.0 < 10.3.13 || >= 10.4.0 < 10.4.3 || >= 11.0.0 < 11.0.12 || >= 11.1.0 < 11.1.3 CVE IDs: CVE-2025-31674 Description: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Arbitrary File Inclusion. Techniques exist to escalate this attack to Remote Code Execution. It is not directly exploitable. This is…