Reflection Injection Vulnerability in Drupal Core
CVE-2026-108097

Currently unrated

Key Information:

Vendor

Drupal
Status
Drupal Core
Vendor
CVE Published:
30 October 2026

What is CVE-2026-108097?

A reflection injection vulnerability in the Drupal core allows an attacker to exploit unsafe reflection methods via externally-controlled input. This could lead to unauthorized access or manipulation of code behavior, affecting various core versions from 8.9.0 to 12.0.0-beta2. Administrators are advised to update their installations to maintain security and integrity.

Affected Version(s)

Drupal core 8.9.0 < 10.6.19

Drupal core 11.0.0 < 11.3.19

Drupal core 11.4.0 < 11.4.10

References

https://www.drupal.org/sa-core-2026-014

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Octavio Galland (ogalland-tob)
catch (catch)
Lee Rowlands (larowlan)
Dave Long (longwave)
Drew Webber (mcdruid)
Jess (xjm)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
catch (catch)
Greg Knaddison (greggles)
Tim Hestenes Lehnen (hestenet)
Lee Rowlands (larowlan)
Dave Long (longwave)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
Pierre Rudloff (prudloff)
Jess (xjm)
.