Packagist/drupal/core CVE-2025-31674: high 7.5, EPSS 0.60%

Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Arbitrary File Inclusion. Techniques exist to escalate this attack to Remote C

Action: Upgrade drupal/core to 10.3.13 or later.

composer require drupal/core:10.3.13

composer require drupal/core:10.4.3

composer require drupal/core:11.0.12

composer require drupal/core:11.1.3

Affected

introduced	fixed	last affected
8.0.0	10.3.13	-
10.4.0	10.4.3	-
11.0.0	11.0.12	-
11.1.0	11.1.3	-

Fixed versions

10.3.13

10.4.3

11.0.12

11.1.3

Sources

osv: DRUPAL-CORE-2025-003
nvd: CVE-2025-31674
https://www.drupal.org/sa-core-2025-003

CVE-2025-31674 · published 2025-02-19T17:03:28Z · modified 2026-09-19T14:41:35Z · JSON