CVE-2019-19826

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-16 · updated 2026-06-17
Weakness: CWE-502

Description

The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demonstrated by PHP object injection, involving a field_names object and an Archive_Tar object, for file deletion. Code execution might also be possible.

Affected products

Drupal Views Dynamic Field: through 6.x-1.4; 7.x-1.0-alpha1, 7.x-1.0-alpha2, 7.x-1.0-alpha3, 7.x-1.0-alpha4

References

https://www.drupal.org/project/views_dynamic_fields/issues/3056600
https://www.drupal.org/project/views_dynamic_fields/issues/3056600

Get alerted when CVE-2019-19826 or the next vulnerability affects your stack