Live › vulnerability › CVE-2026-108097
Drupal core accepts externally controlled input to choose which classes or code run through reflection. The sources do not state what an attacker gets beyond reflection injection.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal core within the affected version ranges are exposed. The sources do not say which request paths, modules or configurations make the input reachable, so treat any internet-facing Drupal site on an affected version as in scope until the vendor advisory is read.
No product ranges from the sources yet.
vendor/bin/drush status or the core_version line in composer.lock.8.9.0 through 10.6.19, 11.0.0 through 11.3.19, 11.4.0 through 11.4.10, and 12.0.0-alpha1 through .12.0.0-beta2No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
This page as .md · .json · in your agent: get_signal("CVE-2026-108097")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.