CVE-2025-13081
- Source
- https://cve.org/CVERecord?id=CVE-2025-13081
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13081.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-13081
- Aliases
- Published
- 2025-11-18T16:54:56.214Z
- Modified
- 2026-07-15T01:48:58.440510161Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006
- Details
-
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
- Database specific
{ "cna_assigner": "drupal", "cwe_ids": [ "CWE-915" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13081.json" }- References
Affected packages
Git / git.drupalcode.org/project/drupal
Affected ranges
- Type
- GIT
- Repo
- https://git.drupalcode.org/project/drupal
- Events
-
Introduced35c2f3ca5c935f3d8bde15932a712677c9bbd50fFixed4507fabeab72c8290872f66b1a1a395bd91585aeIntroducedd4b39f784711f3b861d59c37ec8e9f5592b623ceFixed3f202596d6935bc6915f08b6a1c60e733600d3c1Introduced140f94ff1051644c4416c7ed30cc5dd1f14507b2Fixed5d83fa7b4b4eda5971085af5d5ff00811016376aIntroduced338d58439d5b59d92ac9519ad81ffd916b673841Fixedf8bdd0862798ad59a8ebf87fb1df69642b799f5a
- Database specific
{ "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "8.0.0" }, { "fixed": "10.4.9" }, { "introduced": "10.5.0" }, { "fixed": "10.5.6" }, { "introduced": "11.0.0" }, { "fixed": "11.1.9" }, { "introduced": "11.2.0" }, { "fixed": "11.2.8" } ] }
- Type
- GIT
- Repo
- https://github.com/drupal/drupal
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
{ "cpe": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "source": "CPE_RANGE", "extracted_events": [ { "introduced": "8.0.0" }, { "fixed": "10.4.9" }, { "introduced": "10.5.0" }, { "fixed": "10.5.6" }, { "introduced": "11.0.0" }, { "fixed": "11.1.9" }, { "introduced": "11.2.0" }, { "fixed": "11.2.8" } ] }
Affected versions
10.*
10.0.0-alpha1
10.0.0-alpha3
10.0.0-alpha4
10.0.0-alpha5
10.1.0-alpha1
10.4.0
10.4.0-beta1
10.4.0-rc1
10.4.1
10.4.2
10.4.4
10.4.6
10.4.7
10.4.8
10.5.0
10.5.1
10.5.2
10.5.3
10.5.4
10.5.5
11.*
11.0.0-alpha1
11.1.0
11.1.0-beta1
11.1.0-rc1
11.1.1
11.1.2
11.1.4
11.1.6
11.1.7
11.1.8
11.2.0
11.2.1
11.2.2
11.2.3
11.2.4
11.2.5
11.2.6
11.2.7
8.*
8.0.0
8.1.0-beta1
9.*
9.0.0-alpha1
9.0.0-alpha2