CVE-2026-12535: Drupal Formatter Field Object Injection

CVE-2026-12535 Overview

CVE-2026-12535 is an object injection vulnerability in the Drupal Formatter Field contributed module. The flaw stems from improperly controlled modification of dynamically-determined object attributes [CWE-915], which allows attackers to manipulate PHP object state during deserialization. The issue affects Formatter Field versions from 0.0.0 through 2.0.0. An unauthenticated attacker can exploit this issue over the network without user interaction, leading to full compromise of confidentiality, integrity, and availability on the target Drupal site.

Critical Impact
Remote, unauthenticated object injection in Drupal Formatter Field enables arbitrary code execution and complete site takeover on vulnerable installations.

Affected Products

Drupal Formatter Field module — versions 0.0.0 through 2.0.0
Drupal sites with the contributed Formatter Field module enabled
Any downstream distributions bundling the affected module

Discovery Timeline

2026-07-10 - CVE-2026-12535 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-12535

Vulnerability Analysis

The Formatter Field module fails to safely constrain object attributes that are dynamically set during input handling. When PHP objects are created or hydrated from attacker-supplied data, the module does not validate the class or property names being written. An attacker who influences the serialized payload can instantiate unexpected classes and populate their properties. If any reachable class defines dangerous magic methods such as __wakeup, __destruct, or __toString, execution can pivot into a POP (property-oriented programming) chain that leads to arbitrary code execution.

The issue is tracked under [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes]. It is a variant of the broader insecure deserialization / object injection class of vulnerabilities common in PHP applications.

Root Cause

The root cause is missing allowlisting of classes and properties when the module reconstructs object state from serialized or structured input. Because attributes are assigned dynamically without a schema, an attacker controls which properties on which classes get populated. This turns any gadget class already present in Drupal core, Symfony components, or other contributed modules into a potential exploitation primitive.

Attack Vector

Exploitation requires only network access to a vulnerable Drupal endpoint that consumes the Formatter Field data path. No authentication or user interaction is required. An attacker submits a crafted payload containing a serialized object graph. During processing, the module instantiates and populates the attacker-chosen classes. When a gadget chain is available in the site's autoloadable code, the resulting side effects lead to arbitrary code execution, file writes, or database manipulation. Refer to the Drupal Security Advisory for technical details.

Detection Methods for CVE-2026-12535

Indicators of Compromise

Unexpected PHP files or webshells written under sites/default/files/ or module directories following requests that touched Formatter Field endpoints.
HTTP request bodies containing serialized PHP markers such as O:, a:, or s: submitted to Drupal form or field endpoints.
New or modified administrative Drupal users created outside of normal change windows.
Outbound network connections from the web server process (php-fpm, apache2) to unknown hosts shortly after suspicious POST traffic.

Detection Strategies

Inspect web server and Drupal watchdog logs for anomalous errors from the Formatter Field module, especially unserialize() warnings or class-not-found notices.
Deploy web application firewall rules that flag PHP serialized object patterns in request parameters targeting Drupal endpoints.
Monitor for child processes spawned by the PHP-FPM worker such as sh, bash, curl, or wget, which indicate post-exploitation command execution.

Monitoring Recommendations

Enable file integrity monitoring across the Drupal document root and contributed modules directory.
Alert on writes to .php files outside deployment windows.
Correlate authentication anomalies with recent HTTP traffic to fields rendered by the Formatter Field module.

How to Mitigate CVE-2026-12535

Immediate Actions Required

Identify all Drupal sites running the Formatter Field module and inventory installed versions using drush pm:list or the admin /admin/modules page.
Upgrade the Formatter Field module to a fixed release as directed by the Drupal Security Advisory.
If a patched version is not immediately deployable, disable and uninstall the Formatter Field module.
Review web server and Drupal logs for exploitation attempts dating back to the module's installation.

Patch Information

Drupal has published fix guidance in advisory SA-CONTRIB-2026-048. Site owners should upgrade beyond version 2.0.0 to the release identified in the advisory. Consult the Drupal Security Advisory for exact fixed version numbers and upgrade instructions.

Workarounds

Uninstall the Formatter Field module until the site can be upgraded to a fixed release.
Restrict access to Drupal endpoints that render Formatter Field data using network ACLs or WAF rules that block PHP serialization signatures.
Run the PHP-FPM worker under a least-privilege account with no write access to code directories to limit post-exploitation impact.

bash

# Disable and uninstall the Formatter Field module via Drush
drush pm:uninstall formatter_field -y
drush cache:rebuild

# Verify the module is no longer enabled
drush pm:list --status=enabled | grep -i formatter_field