Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2019-6340

CVE-2019-6340HIGH

Drupal core - Highly critical - Remote Code Execution

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .9202   99.8   YES

AFFECTED
  Product      Versions  Fixed
  Drupal Core  8.5 –     —

TIMELINE
  Jan 15  Reserved by drupal
  Feb 21  Published (CNA: drupal)
  Mar 25  Added to CISA KEV, remediation due 2022-04-15

CWE-502 · CNA: drupal · CVSS v3.1 · 7 references · KEV due April 15, 2022

Description

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 15, 2019	Reserved	Reserved by drupal
February 21, 2019	Published	Published (CNA: drupal)
March 25, 2022	KEV ADDED	Added to CISA KEV, remediation due 2022-04-15

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Drupal	Drupal Core	—	8.5	—

Weaknesses

CWE-502

References (7)

http://www.securityfocus.com/bid/107106 [vdb-entry, x_refsource_BID]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340 [government-resource]
https://www.drupal.org/sa-core-2019-003 [x_refsource_CONFIRM]
https://www.exploit-db.com/exploits/46452/ [exploit, x_refsource_EXPLOIT-DB]
https://www.exploit-db.com/exploits/46459/ [exploit, x_refsource_EXPLOIT-DB]
https://www.exploit-db.com/exploits/46510/ [exploit, x_refsource_EXPLOIT-DB]
https://www.synology.com/security/advisory/Synology_SA_19_09 [x_refsource_CONFIRM]

Authoritative record: CVE-2019-6340 at cve.org

Vendors: drupal

Weaknesses: CWE-502

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2019-6340 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.