Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Artbitrary File Deletion. It is not directly exploitable.
This issue is mitigated by the fact that in order to be exploitable, a separate vulnerability must be present that allows an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.
This vulnerability affects the following application versions:
- Drupal 9.5.6
- Drupal 9.5.7
- Drupal 9.5.8
- Drupal 9.5.9
- Drupal 9.5.10
- Drupal 9.5.11
- Drupal 10.0.6
- Drupal 10.0.7
- Drupal 10.0.8
- Drupal 10.0.9
- Drupal 10.0.10
- Drupal 10.0.11
- Drupal 10.1.0
- Drupal 10.1.1
- Drupal 10.1.2
- Drupal 10.1.3
- Drupal 10.1.4
- Drupal 10.1.5
- Drupal 10.1.6
- Drupal 10.1.7
- Drupal 10.1.8
- Drupal 10.2.0
- Drupal 10.2.1
- Drupal 10.2.2
- Drupal 10.2.3
- Drupal 10.2.4
- Drupal 10.2.5
- Drupal 10.2.6
- Drupal 10.2.7
- Drupal 10.2.8
- Drupal 10.2.9
- Drupal 10.2.10
- Drupal 10.3.0
- Drupal 10.3.1
- Drupal 10.3.2
- Drupal 10.3.3
- Drupal 10.3.4
- Drupal 10.3.5
- Drupal 10.3.6
- Drupal 10.3.7
- Drupal 10.3.8
- Drupal 11.0.0
- Drupal 11.0.1
- Drupal 11.0.2
- Drupal 11.0.3
- Drupal 11.0.4
- Drupal 11.0.5
- Drupal 11.0.6
- Drupal 11.0.7