-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in contextual links processing. The ContextualController::renderLinks method handles user-submitted serialized data (via 'ids' parameter) to generate contextual links. The advisory indicates insufficient validation of these contextual links requests, which aligns with deserialization vulnerabilities (CWE-20). Drupal's patch would have addressed this by adding validation/sanitization before deserialization. The method's role in processing untrusted input and the RCE outcome strongly suggest this as the vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/drupal | composer | >= 8.0.0, < 8.5.8 | 8.5.8 |
| drupal/drupal | composer | >= 8.6.0, < 8.6.2 | 8.6.2 |
PHPPHPOngoing coverage of React2Shell