drupal/core · Security
Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
- GHSA ID
- GHSA-7v68-3pr5-h3cr
- Severity
- critical
- Published
- Updated
Description
The Contextual Links module doesn't sufficiently validate the requested contextual links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access contextual links".
CWEs
- CWE-94 · Improper Control of Generation of Code ('Code Injection')