CVE-2026-12535 Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
An attacker can exploit PHP object injection in the Drupal Formatter Field module to potentially execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-12535?
CVE-2026-12535 is a critical unsafe deserialization vulnerability in Drupal Formatter Field, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.
Weakness: CWE-915
Which versions are affected by CVE-2026-12535?
It affects 1 product.
Linux distribution packages (1)
drupal/formatter_field Packagist:https://packages.drupal.org/8 | All versions | 2.0.0 |
Products include Zroger Formatter Field.
How do I fix CVE-2026-12535?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-12535 being exploited?
There is no known exploitation of CVE-2026-12535 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2026-048, GHSA-qc2r-2xxp-m58x.