CVE-2026-108097
Low risk· EPSS 26%Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Drupal core contains an Unsafe Reflection vulnerability that uses externally-controlled input to select classes or code. This issue affects Drupal core versions from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
Risk Assessment
An attacker could exploit this flaw to perform reflection injection and potentially execute unauthorized code or access sensitive information.
Recommendation
Update Drupal core to the latest version in the appropriate branch (e.g., 10.6.20, 11.3.20, 11.4.11 or later) to remediate the vulnerability.
Other vulnerabilities in Drupal core
See all- CVE-2020-13671HighActively exploited
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects Drupal Core 9.0 versions prior to 9.0.8, 8.9 prior to 8.9.9, 8.8 prior to 8.8.11, and 7 prior to 7.74.
- CVE-2026-108515Low risk· EPSS 9%
Drupal core contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Drupal core versions from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
- CVE-2026-108514Low risk· EPSS 9%
Drupal core contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Drupal core versions from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
- CVE-2026-55805Medium
Drupal core has a Stored XSS vulnerability due to improper neutralization of input during web page generation. Affected versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and some 11.0.*, 11.1.*, 11.2.* versions.
- CVE-2026-15917Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.2.*.
- CVE-2026-15916Medium
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects versions: up to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.0.*, 11.1.*, and 11.2.*.
- CVE-2026-55808Medium
A Cross-Site Scripting (XSS) vulnerability has been discovered in Drupal Core due to improper input neutralization during web page generation. It affects a wide range of versions: from 0.0.0 to 10.5.12, 10.6.0-10.6.11, 11.2.0-11.2.14, 11.3.0-11.3.12, and all 11.0.* and 11.1.* releases.
- CVE-2026-55807Low
SSRF vulnerability in Drupal core allows an attacker to send requests from the server to internal network resources. The issue affects multiple Drupal versions including 10.5.x, 10.6.x, 11.2.x, 11.3.x, and older branches 11.0.x and 11.1.x.
- CVE-2026-55806Medium
An Open Redirect vulnerability in Drupal core allows URL redirection to untrusted sites, enabling content spoofing. This affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and older branches 11.0.* and 11.1.*.
- CVE-2026-55804Medium
An improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. Affected versions include Drupal core from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and branches 11.0.* and 11.1.*.
Original NVD description (English source)
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS