Description
In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Drupal Core | Drupal / Drupal Core | >= 8.5, < 8.5.11 | affected |
| Drupal Core | Drupal / Drupal Core | >= 8.6, < 8.6.10 | affected |