{"action":"Upgrade drupal/core to 7.62.0 or later.","affected":[{"fixed":"7.62.0","introduced":"7.0.0"},{"fixed":"8.5.9","introduced":"8.0.0"},{"fixed":"8.6.6","introduced":"8.6.0"}],"component":"drupal/core","cve_ids":["CVE-2019-6339"],"ecosystem":"Packagist","epss":0.35577,"exploited":false,"fixed_versions":["7.62.0","8.5.9","8.6.6"],"ghsa_id":"GHSA-8cw5-rv98-5c46","id":"tcs_01M5KEYYM4VMF07HJ67ZPWGVJQ","modified_at":"2025-12-10T23:41:22.974426Z","published_at":"2022-01-06T22:30:06Z","references":["https://osv.dev/vulnerability/GHSA-8cw5-rv98-5c46","https://nvd.nist.gov/vuln/detail/CVE-2019-6339","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6339.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6339.yaml","https://lists.debian.org/debian-lts-announce/2019/02/msg00004.html","https://www.debian.org/security/2019/dsa-4370","https://www.drupal.org/sa-core-2019-002"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-8cw5-rv98-5c46#Packagist/drupal/core","url":"https://osv.dev/vulnerability/GHSA-8cw5-rv98-5c46"}],"summary":"Arbitrary PHP code execution in Drupal"}