---
id: "CVE-2026-108097"
kind: "vulnerability"
aliases: ["CVE-2026-108097"]
title: "Drupal core: externally controlled input can select code classes, enabling reflection injection"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["drupal", "php", "runtime", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-10-30T04:18:04+00:00"
first_seen_at: "2026-10-30T04:28:36+00:00"
updated_at: "2026-10-30T04:31:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108097", "first_seen_at": "2026-10-30T04:28:36+00:00"}]
---

# Drupal core: externally controlled input can select code classes, enabling reflection injection

Drupal core accepts externally controlled input to choose which classes or code run through reflection. The sources do not state what an attacker gets beyond reflection injection.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Drupal core version in use, for example with `vendor/bin/drush status` or the `core_version` line in `composer.lock`.
- Versions affected per the sources: `8.9.0` through `10.6.19`, `11.0.0` through `11.3.19`, `11.4.0` through `11.4.10`, and `12.0.0-alpha1` through `12.0.0-beta2`.

## Timeline

- 2026-10-30T04:28:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108097

## From the sources

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_