GHSA-7v68-3pr5-h3cr: Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
The Contextual Links module doesn't sufficiently validate the requested contextual links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access contextual links".
Published May 15, 2024
Affected packages
drupal/core
- Ecosystem
- Composer (PHP)
- Affected
- >= 8.0.0, < 8.5.8
- Fixed in
- 8.5.8
- Check
composer show drupal/core
drupal/core
- Ecosystem
- Composer (PHP)
- Affected
- >= 8.6.0, < 8.6.2
- Fixed in
- 8.6.2
- Check
composer show drupal/core
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The Contextual Links module doesn't sufficiently validate the requested contextual links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access contextual links".
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Composer (PHP) vulnerabilities
All Composer (PHP) entriesCVE-2026-9082
Drupal Core has a SQL Injection issue
critical9.8ExploitedMay 20, 2026GHSA-6mgp-v5cm-ghg5
Drupal core Remote Code Execution
criticalMay 15, 2024CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
critical9.8ExploitedApr 23, 2024CVE-2019-6342
Drupal Improper Access Control
critical9.8Jan 11, 2024