DRUPAL-CONTRIB-2026-253: Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253

Q: Which installations are affected?

Drupal sites using the Monster Menus module in versions from 0.0.0 through 9.5.6 are affected.

Q: What level of access does an attacker need?

The CVSS vector indicates that an attacker needs low privileges (PR:L). Exploitation is network-accessible, requires low attack complexity, and does not require user interaction.

Q: What impact could successful exploitation have?

Successful exploitation can affect confidentiality, integrity, and availability at a high level. The vulnerability is classified as PHP object injection.

Published Oct 30, 2026

Updated

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.

Affected Software

1 affected component

Drupal Monster Menus>=0.0.0<=9.5.6

Event History

Oct 30, 2026

CVE Published

via OSV·03:09 AM

Data Sourced

via OSV·03:09 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Drupal sites using the Monster Menus module in versions from 0.0.0 through 9.5.6 are affected.

What level of access does an attacker need?

The CVSS vector indicates that an attacker needs low privileges (PR:L). Exploitation is network-accessible, requires low attack complexity, and does not require user interaction.

What impact could successful exploitation have?

Successful exploitation can affect confidentiality, integrity, and availability at a high level. The vulnerability is classified as PHP object injection.

DRUPAL-CONTRIB-2026-253: Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What impact could successful exploitation have?