Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

{
  "id": "30cd9bd8963c3964ed2bf5c021b0ec1a97f6b344b2fa50f904897abf50643766",
  "url": "https://www.drupal.org/sa-core-2026-006",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006",
    "summary": "Drupal core has a gadget chain that may enable remote code execution or SQL injection when a separate vulnerability allows unsafe input to be deserialized. The issue is not directly exploitable; update to a fixed release.",
    "evidence": "Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site.",
    "products": [
      {
        "name": {
          "value": "Drupal core",
          "evidence": "Project: Drupal core"
        },
        "prerequisites": [
          {
            "value": "a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize().",
            "evidence": "This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize()."
          }
        ],
        "fixed_versions": [
          {
            "value": "11.3.12",
            "evidence": "If you use Drupal 11.3.x, update to Drupal 11.3.12."
          },
          {
            "value": "11.2.14",
            "evidence": "If you use Drupal 11.2.x, update to Drupal 11.2.14."
          },
          {
            "value": "10.6.11",
            "evidence": "If you use Drupal 10.6.x, update to Drupal 10.6.11."
          },
          {
            "value": "10.5.12",
            "evidence": "If you use Drupal 10.5.x, update to Drupal 10.5.12."
          }
        ],
        "affected_versions": [
          {
            "value": "<10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.*",
            "evidence": "Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.*"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-55804",
        "evidence": "CVE IDs: CVE-2026-55804"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-drupal-security",
  "document_id": 23462,
  "published_at": "2026-06-17T18:57:02+00:00"
}