tocsin

Packagist/drupal/core CVE-2026-6366: unknown, EPSS 0.42%

Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a v

Action: Upgrade drupal/core to 10.5.9 or later.

composer require drupal/core:10.5.9
composer require drupal/core:10.6.7
composer require drupal/core:11.2.11
composer require drupal/core:11.3.7

Affected

introducedfixedlast affected
8.0.010.5.9-
10.6.010.6.7-
11.0.011.2.11-
11.3.011.3.7-

Fixed versions

10.5.910.6.711.2.1111.3.7

Sources

CVE-2026-6366 · published · modified · JSON