{"id":"CVE-2026-108097","title":"Drupal core - Critical - Remote code execution - SA-CORE-2026-014","summary":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, f…","severity":"none","cwe":["CWE-470"],"vendor":"Drupal","product":"Drupal core","affected":["core >= 8.9.0 < 10.6.19","core >= 11.0.0 < 11.3.19","core >= 11.4.0 < 11.4.10","core >= 12.0.0-alpha1 < 12.0.0-beta2"],"exploitAvailable":true,"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T03:09:55.043Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108097","references":[{"url":"https://www.drupal.org/sa-core-2026-014"}],"tags":["cve.org","exploit-available"],"epss":0.00326,"epssPercentile":0.25715,"exploits":{"github":3,"githubRepos":["https://github.com/fortbridge/cve-2026-108097-research","https://github.com/FurkanKAYAPINAR/CVE-2026-108097","https://github.com/ExDev994/CVE-2026-108097"],"checkedAt":"2026-11-03T10:42:39.149Z"},"ingestedAt":"2026-11-03T10:42:03.621Z","slug":"CVE-2026-108097","body":"## Overview\n\nUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.\n\n## Affected\n\n- `core >= 8.9.0 < 10.6.19`\n- `core >= 11.0.0 < 11.3.19`\n- `core >= 11.4.0 < 11.4.10`\n- `core >= 12.0.0-alpha1 < 12.0.0-beta2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":15,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}