Vulnerability in Drupal Core

CVE-2025-31674

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 be…

Vulnerability class: Mass Assignment

EPSS: 0.003 (54.8th percentile) — read the EPSS interpretation.