CVE-2026-114573

Name of the Vulnerable Software and Affected Versions Drupal Monster Menus versions 0.0.0 through 9.5.6

Description Improperly controlled modification of dynamically-determined object attributes in the Drupal Monster Menus module allows for object injection. Specifically, the RSS Page submodule uses the PHP unserialize() function when processing input from the node creation form. This allows an attacker with the "RSS Feed: Create new content" permission to inject PHP objects. Object injection is a condition where untrusted input is passed to a deserialization function, potentially allowing the execution of arbitrary code or manipulation of application logic.

Recommendations Update Drupal Monster Menus to a version later than 9.5.6. As a temporary mitigation, disable the RSS Page submodule or restrict the "RSS Feed: Create new content" permission to trusted users only.