SA-CONTRIB-2026-253: Critical severity drupal/monster_menus vulnerability

Q: Who is exposed to this issue?

Sites using the Drupal Monster Menus module are exposed only if its RSS Page submodule is enabled and a user has the "RSS Feed: Create new content" permission.

Q: What access does an attacker need to exploit it?

An attacker needs an account or role that can create RSS Feed content. The vulnerable processing occurs when input from the node creation form is handled.

Published Oct 21, 2026

Updated

This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds. When the input of the node creation form is processed, it makes use of PHP's unserialize function. This introduces a PHP object injection vulnerability. This vulnerability is mitigated by the fact that the RSS Page submodule must be enabled and an attacker must have a role with the permission "RSS Feed: Create new content".

Credit

Drew Webber (mcdruid)(the Drupal Security Team)

Affected Software

1 affected componentFixes available

drupal/monster_menus<9.5.6

9.5.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/monster_menus to a version that resolves this vulnerability.
Fixed in 9.5.6

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114573

Frequently Asked Questions

Who is exposed to this issue?

Sites using the Drupal Monster Menus module are exposed only if its RSS Page submodule is enabled and a user has the "RSS Feed: Create new content" permission.

What access does an attacker need to exploit it?

An attacker needs an account or role that can create RSS Feed content. The vulnerable processing occurs when input from the node creation form is handled.

SA-CONTRIB-2026-253: Critical severity drupal/monster_menus vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?