{"id":"CVE-2026-108097","kind":"vulnerability","aliases":["CVE-2026-108097"],"related":[],"title":"Drupal core: externally controlled input can select code classes, enabling reflection injection","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.","summary":"Drupal core accepts externally controlled input to choose which classes or code run through reflection. The sources do not state what an attacker gets beyond reflection injection.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","php","runtime","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the Drupal core version in use, for example with `vendor/bin/drush status` or the `core_version` line in `composer.lock`.\n- Versions affected per the sources: `8.9.0` through `10.6.19`, `11.0.0` through `11.3.19`, `11.4.0` through `11.4.10`, and `12.0.0-alpha1` through `12.0.0-beta2`.","fix":null,"status":"open","published_at":"2026-10-30T04:18:04+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:21+00:00","updated_at":"2026-10-30T04:31:21+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-30T04:31:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Drupal core: externally controlled input can select code classes, enabling reflection injection","impact":"high","summary":"Drupal core accepts externally controlled input to choose which classes or code run through reflection. The sources do not state what an attacker gets beyond reflection injection.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; reflection injection may allow arbitrary code execution","analyst_note":"Read the Drupal security advisory for CVE-2026-108097 to confirm the fixed versions, the trigger path and whether authentication is needed; the NVD entry alone lacks these.","how_to_check":"- Check the Drupal core version in use, for example with `vendor/bin/drush status` or the `core_version` line in `composer.lock`.\n- Versions affected per the sources: `8.9.0` through `10.6.19`, `11.0.0` through `11.3.19`, `11.4.0` through `11.4.10`, and `12.0.0-alpha1` through `12.0.0-beta2`.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites running Drupal core within the affected version ranges are exposed. The sources do not say which request paths, modules or configurations make the input reachable, so treat any internet-facing Drupal site on an affected version as in scope until the vendor advisory is read.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4174,"output_tokens":578,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108097':15A,18A '-2026':14A,17A '10.6.19':82C '11.0.0':84C '11.3.19':86C '11.4.0':88C '11.4.10':90C '12.0.0':92C,95C '8.9.0':80C 'accept':27B 'affect':75C 'allow':70C 'alpha1':93C 'attack':47B 'beta2':96C 'beyond':49B 'choos':32B 'class':9A,34B,60C 'code':8A,36B,62C 'control':4A,29B,56C 'core':2A,26B,69C,77C 'cve':13A,16A 'drupal':1A,19B,25B,67C,68C,76C 'enabl':10A 'extern':3A,28B,55C 'externally-control':54C 'get':48B 'host':24B 'inject':12A,51B,72C 'input':5A,30B,57C 'issu':74C 'php':20B 'reflect':11A,39B,50B,64C,71C 'run':37B 'runtim':21B 'select':7A,59C 'self':23B 'self-host':22B 'sourc':41B 'state':44B 'unsaf':63C 'use':52C 'version':78C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal core within the affected version ranges are exposed. The sources do not say which request paths, modules or configurations make the input reachable, so treat any internet-facing Drupal site on an affected version as in scope until the vendor advisory is read.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108097","severity":null,"published_at":"2026-10-30T04:18:04+00:00","modified_at":"2026-10-30T04:18:04+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}