Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Drupal | Drupal core | 8.9.0 – < 10.6.19, 11.0.0 – < 11.3.19, 11.4.0 – < 11.4.10, 12.0.0-alpha1 – < 12.0.0-beta2 | 10.6.19 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 3 repositories
-
fortbridge/cve-2026-108097-research ★ 1 · Oct 18, 2026
-
ExDev994/CVE-2026-108097 ★ 0 · Oct 20, 2026
CVE-2026-108097
-
FurkanKAYAPINAR/CVE-2026-108097 ★ 0 · Oct 15, 2026
Defensive, non-exploit detector for CVE-2026-108097 (SA-CORE-2026-014) — Drupal core Field UI RCE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.9.0, < 10.6.19 · >= 11.0.0, < 11.3.19 · >= 11.4.0, < 11.4.10 · >= 12.0.0-alpha1, < 12.0.0-beta2 | 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 | DRUPAL-CORE-2026-014 |
Advisories 2
- WID-SEC-2026-3968 Drupal Core, Gin Admin Theme und Entity List: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 29, 2026
- NCSC-2026-0438 Kwetsbaarheden verholpen in Drupal Core en modules door Drupal NCSC-NL (Netherlands) · Oct 19, 2026