Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Vulnerability

Overview

CVE-2025-31674 is a vulnerability in Drupal core that arises from an improperly controlled modification of dynamically-determined object attributes [2]. This flaw falls under the category of "Object Injection," specifically a PHP object injection vulnerability that can lead to arbitrary file inclusion and, when chained with other exploits, remote code execution [3].

Attack

Vector

The vulnerability is not directly exploitable on its own; it requires a separate bug in Drupal core or a contributed module that allows an attacker to pass unsanitized input to PHP's unserialize() function [3]. An attacker must first find such a separate exploit path to inject malicious serialized data, which then leverages the improper attribute modification to trigger object instantiation and subsequent code execution.

Impact

Successful exploitation of this gadget chain could allow an attacker to achieve arbitrary file inclusion and remote code execution, potentially leading to full site compromise, data theft, or site defacement [2][3]. The severity is rated as moderately critical by the Drupal security team, reflecting the need for a secondary vulnerability to be present.

Mitigation

Drupal has released patched versions to address this issue: upgrade to Drupal 10.3.13, 10.4.3, 11.0.12, or 11.1.3, depending on your branch [3]. Versions older than 10.3.x (including Drupal 8 and 9) are end-of-life and no longer receive security coverage, so users running those versions should upgrade to a supported release immediately. No workaround is provided beyond upgrading.