{"id":"DRUPAL-CONTRIB-2026-038","aliases":["CVE-2026-9726"],"title":"DRUPAL-CONTRIB-2026-038","description":"The Basket module enables e-commerce and checkout functionality for Drupal sites.\n\nThe module does not sufficiently sanitize user-supplied data before passing it to PHP's unserialize().\n\nAn attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the site codebase or installed dependencies, this can result in arbitrary PHP code execution.","severity":"unknown","score":null,"published":"2026-05-27T18:32:18.000Z","modified":"2026-09-10T03:45:23.862Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/basket","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.1.17"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<2.1.17"}}],"versions":[],"fixed":["2.1.17"]}],"references":["https://www.drupal.org/sa-contrib-2026-038"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2026-038","modified":"2026-09-10T03:45:23.862339972Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-038"}],"assessments":[]}