CVE-2026-114573: Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253
Published Oct 30, 2026
·Updated
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.
Affected Software
1 affected component
Drupal Monster Menus>=0.0.0<=9.5.6
Event History
Oct 30, 2026
CVE Published
via MITRE·03:09 AM
Data Sourced
via MITRE·03:09 AM
DescriptionWeakness
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Monster Menus versions are affected?
Monster Menus versions from 0.0.0 through 9.5.6 are affected.
2
What weakness does this issue involve?
The issue is an improperly controlled modification of dynamically determined object attributes that allows PHP object injection.