CVE-2026-55803 Drupal core - Critical - PHP object injection - SA-CORE-2026-005
Drupal core allows PHP object injection, potentially enabling remote code execution for attackers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55803?
CVE-2026-55803 is a medium-severity unsafe deserialization vulnerability in Drupal Drupal, published on 10 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
Weakness: CWE-915
Which versions are affected by CVE-2026-55803?
2 open source packages ship an affected version, including drupal and drupal/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal Bitnami | All versions | 10.5.12, 10.6.11, 11.2.14, 11.3.12 |
drupal/core Packagist | All versions | 10.5.12, 10.6.11, 11.2.14, 11.3.12, 11.1.0, 11.2.0 |
Products include Drupal Drupal.
How do I fix CVE-2026-55803?
Upgrade drupal to a fixed version for your release line: 10.5.12, 10.6.11, 11.2.14 or 11.3.12.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-55803 being exploited?
There is no known exploitation of CVE-2026-55803 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as BIT-drupal-2026-55803, DRUPAL-CORE-2026-005, GHSA-25f6-4hrw-j87c, MINI-5fv2-3vwc-3gwm, MINI-79wv-265x-5r66.