ZeroDay Findings
Sign inSign up

Findings

CVE-2019-6340

Drupal Core Remote Code Execution Vulnerability

Published Feb 21, 2019 · updated Jun 16, 2026 · drupal drupal

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

Timeline

Detection, updates, and resolution for this record.

  1. Feb 21, 2019 · Catalog

    Detected

    Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another

Required action

Apply updates per vendor instructions.

CISA due date Apr 15, 2022

Affected

  • cpe drupal/drupalversion unspecified
  • vendor Drupal Coreversion unspecified

Sources

  • CISA KEVCVE-2019-6340

    In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.

    cisa.gov
  • CVE.orgCVE-2019-6340

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-6340

    30-day exploitation probability 92.0%

    first.org
  • Exploit Database46452

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database46510

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_unix/webapp/drupal_restws_unserialize

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2019-6340

    Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has

    nvd.nist.gov

References