CVE-2026-55804
Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
Description
Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability. This issue is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to `unserialize()`.
How to fix CVE-2026-55804
To remediate CVE-2026-55804, upgrade the affected package to a fixed version below.
- —upgrade to 10.5.12 or later
- —upgrade to 10.5.12 or later
Is CVE-2026-55804 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 10.5.12, >= 10.6.0, < 10.6.11, >= 11.0.0, < 11.2.14, >= 11.3.0, < 11.3.12
- from 0, < 10.5.12 | >= 10.6.0, < 10.6.11 | >= 11.2.0, < 11.2.14 | >= 11.3.0, < 11.3.12 | >= 11.0.0, < 11.1.0 | >= 11.1.0, < 11.2.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N |