CVE-2025-13081: 
PHP vulnerability analysis and mitigation

CVE-2025-13081 is an object injection vulnerability in Drupal core caused by improperly controlled modification of dynamically-determined object attributes (CWE-915 / CWE-502). It affects Drupal core versions from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, and from 11.2.0 before 11.2.8. The vulnerability was published on November 18, 2025. It carries a CVSS v3.1 base score of 5.9 (Medium) and a CVSS v4.0 base score of 4.5 (Moderate) (GitHub Advisory, Drupal Advisory).

The root cause is classified under CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) and CWE-502 (Deserialization of Untrusted Data). An attacker can supply crafted input that manipulates dynamically-determined object attributes in Drupal core, enabling object injection — a technique where attacker-controlled data is deserialized into PHP objects, potentially triggering unintended code paths or gadget chains. Exploitation requires high privileges and high attack complexity, and is conducted over the network without user interaction (GitHub Advisory, Drupal Advisory).

Successful exploitation by a high-privileged attacker could result in high confidentiality and high integrity impact on the affected Drupal installation, potentially enabling unauthorized access to sensitive data and unauthorized modification of system data. Availability is not directly impacted. The scope is limited to the vulnerable system itself, with no confirmed lateral movement to subsequent systems (GitHub Advisory, Drupal Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation of CVE-2025-13081. The EPSS score is approximately 0.11–0.135%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges and high attack complexity, which significantly limits the attacker pool (GitHub Advisory, Drupal Advisory).

Drupal has released patched versions addressing this vulnerability. Administrators should upgrade to one of the following fixed releases as soon as possible:

• 10.4.9 or later (for the 10.4.x branch)
• 10.5.6 or later (for the 10.5.x branch)
• 11.1.9 or later (for the 11.1.x branch)
• 11.2.8 or later (for the 11.2.x branch)

Additional recommended mitigations include implementing strict input validation, restricting and carefully managing user privileges to limit the attack surface, and monitoring for suspicious object manipulation attempts. A thorough security audit of existing Drupal installations is also advised (Drupal Advisory, GitHub Advisory).

The vulnerability received routine coverage from security aggregators and vulnerability tracking platforms following its November 18, 2025 disclosure, including Tenable plugin coverage and entries in ENISA's EUVD database. No notable researcher commentary, vendor statements beyond the official Drupal security advisory, or significant social media discussion has been identified (Drupal Advisory).