CVE-2025-13081

CVE-2025-13081: Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006

Vendor Drupal
Product Drupal core
Weakness CWE-915
Published November 18, 2025
Last update February 26, 2026
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

Key dates

02Disclosure timeline

November 18, 2025 CVE published
February 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003 CVE-2026-55803 Drupal core - Critical - PHP object injection - SA-CORE-2026-005 CVE-2026-48943 Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26 CVE-2026-15083 ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074 CVE-2024-55637 Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007