Monster menus: This module enables you to create one or more multisites with highly granular page permissions. (CVE-2026-114573)

The Monster menus Drupal module contains a PHP object injection vulnerability in its RSS Page submodule. This occurs because the node creation form input is processed using PHP's unserialize function without sufficient validation, allowing an attacker with the appropriate permission to inject malicious PHP objects. The vulnerability is conditional on the RSS Page submodule being enabled and the attacker having the 'RSS Feed: Create new content' permission. Versions of the module prior to 9.5.6 are affected. A patch is available to remediate this issue.

Successful exploitation could allow an attacker with the 'RSS Feed: Create new content' permission to perform PHP object injection, potentially leading to arbitrary code execution or other impacts depending on the injected payload. However, exploitation is limited by the requirement that the RSS Page submodule is enabled and the attacker has the necessary permission, reducing the attack surface.

A patch is available for this vulnerability. Users should upgrade to version 9.5.6 or later of the Monster menus module. Additionally, restricting the 'RSS Feed: Create new content' permission to trusted roles and disabling the RSS Page submodule if not needed can reduce risk.