Project:
Project machine name:
groupexproDate:
2026-November-04
Vulnerability:
PHP object injection
Affected versions:
<2.2.1
CVE IDs:
CVE-2026-118565
Description:
Integration with GroupEx PRO system, decoupled from Open Y.
The module does not sufficiently validate user inputs in some scenarios, potentially leading to arbitrary remote code execution.
Note: This project was marked as Unsupported by the Drupal Security Team on 2026-10-28 but a fix was released and the project restored on 2026-11-04.
Solution:
Install the latest version:
- If you use GroupEx PRO module upgrade to GroupEx PRO 2.2.1.
Reported By:
- Drew Webber (mcdruid) of the Drupal Security Team
Fixed By:
Coordinated By:
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
