CVE-2019-6340

Drupal core - Highly critical - Remote Code Execution

State: Published
Severity: 8.1 High
Published: Feb 21, 2019
Updated: Oct 21, 2025
Reserved: Jan 15, 2019

Description

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
Drupal CoreDrupal	8.5 to before 8.5.11Affected 8.6 to before 8.6.10Affected

References

https://www.synology.com/security/advisory/Synology_SA_19_09
46452exploit
https://www.drupal.org/sa-core-2019-003
46510exploit
107106vdb-entry
46459exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.