CVE-2026-114573 drupal CVE debrief

Who should care

Drupal administrators and security teams should assess exposure, especially in environments where the Monster Menus module's RSS Page submodule is used and users have specific permissions. This includes roles responsible for maintaining Drupal installations and monitoring for suspicious activities.

Why it matters

CVE-2026-114573 is a PHP object injection vulnerability in the Monster Menus module for Drupal. It requires specific conditions to be exploitable, including the RSS Page submodule being enabled and an attacker having a particular role permission. Defenders should verify exposure, prioritize remediation, and monitor for suspicious activities.

• Potential for attackers to inject malicious PHP objects if the RSS Page submodule is enabled and an attacker has the 'RSS Feed: Create new content' permission.
• Requires verification of exposure in Drupal environments using the Monster Menus module.
• Remediation priority for environments where the submodule is enabled and vulnerable versions are in use.
• Limited information available on exploitation or impact; further verification needed.

Technical summary

The Monster Menus module for Drupal, specifically the RSS Page submodule, is vulnerable to a PHP object injection attack. This is due to the use of PHP's unserialize function when processing node creation form input. The vulnerability requires the RSS Page submodule to be enabled and an attacker to have a role with 'RSS Feed: Create new content' permission. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds. When the input of the node creation form is processed, it makes use of PHP's unserialize function.

Defensive priority

Defenders should prioritize verifying exposure in their Drupal environments, especially where the Monster Menus module's RSS Page submodule is enabled and users have the 'RSS Feed: Create new content' permission. Remediation involves updating to a version that patches this vulnerability.

Recommended defensive actions

• Verify if the Monster Menus module, specifically the RSS Page submodule, is enabled in your Drupal environment.
• Check if any user roles have the 'RSS Feed: Create new content' permission.
• Update the Monster Menus module to a version that addresses this vulnerability, if available.
• Monitor for any suspicious activities related to node creation and RSS feed aggregation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is introduced by the use of PHP's unserialize function when processing input from the node creation form in the RSS Page submodule. This requires the submodule to be enabled and an attacker to have a specific role permission.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.