CVE-2026-108097: Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Published Oct 30, 2026
·Updated
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Event History
Oct 30, 2026
CVE Published
via MITRE·03:09 AM
Data Sourced
via MITRE·03:09 AM
DescriptionWeakness
Data Sourced
via NVD·04:18 AM
DescriptionWeakness
Frequently Asked Questions
1
Which Drupal core installations are affected?
Affected versions are 8.9.0 through 10.6.19, 11.0.0 through 11.3.19, 11.4.0 through 11.4.10, and 12.0.0-alpha1 through 12.0.0-beta2. The provided data does not identify fixed versions.
2
What is the underlying issue and potential impact?
The issue is unsafe reflection: externally controlled input can be used to select classes or code. It is classified as critical and can allow remote code execution.