Conditional arbitrary file deletion via gadget chain

PHP object injection in affected Drupal Core releases allows attackers to delete arbitrary files through a deserialization gadget chain. Dynamically determined object properties in a chain of unnamed core classes reach file-deletion behavior when unsafe serialized input enters unserialize(). Exploitation requires a separate flaw that supplies that input; the chain is not directly exploitable, and Drupal reports no such Drupal Core exploit.