CVE-2025-13081: Drupal

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

Affected products

• Drupal Drupal: from 8.0.0, before 10.4.9 (fixed in 10.4.9); from 10.5.0, before 10.5.6 (fixed in 10.5.6); from 11.0.0, before 11.1.9 (fixed in 11.1.9); from 11.2.0, before 11.2.8 (fixed in 11.2.8)

Published 2025-11-18. Last modified 2026-06-17.