CVE-2019-19826

CRITICAL

Drupal Views Dynamic Fields <= 7.x-1.0-alpha4 - PHP Object Injection via Insecure Unserialize

Title source: llm
STIX 2.1

Description

The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demonstrated by PHP object injection, involving a field_names object and an Archive_Tar object, for file deletion. Code execution might also be possible.

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0155
EPSS Percentile 81.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (2)
drupal/views_dynamic_field 7.x-1.0 alpha1 (4 CPE variants)
drupal/views_dynamic_field < 6.x-1.4
Published Dec 16, 2019
Tracked Since Feb 18, 2026