CVE-2025-31674: Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.49135%
CWE
Published
4/1/2025
Updated
4/1/2025
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/core | composer | >= 8.0.0, < 10.3.13 | 10.3.13 |
| drupal/core | composer | >= 10.4.0, < 10.4.3 | 10.4.3 |
| drupal/core | composer | >= 11.0.0, < 11.0.12 | 11.0.12 |
| drupal/core | composer | >= 11.1.0, < 11.1.3 | 11.1.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability centers around improper unserialization leading to object injection. Drupal's PhpSerialize::decode() method is the primary location where unserialize() operations occur. In vulnerable versions, this method would lack proper allowed_classes restrictions. The security advisory indicates the issue is mitigated by requiring separate input validation, implying the core vulnerability exists at the unserialization point. While no direct patch diff is available, the CWE-915 pattern and Drupal's architecture strongly suggest PhpSerialize::decode as the vulnerable function when handling untrusted data.