SQL injection vulnerability affecting Drupal Core
A vulnerability affecting Drupal core would allow an unauthenticated attacker to remotely cause arbitrary SQL injection on affected systems using PostgreSQL.
Description
Technical context and vulnerability details
Drupal is an open source content management system (CMS) widely used for creating and managing websites and online applications. This tool is affected by the vulnerability labeled CVE-2026-9082, due to insufficient validation of user inputs in the Drupal Core database abstraction API, allowing SQL injection via the EntityQuery condition handler for PostgreSQL. Exploitation of this vulnerability would allow a malicious actor, by sending specially crafted queries, to inject malicious SQL statements into a Drupal site using PostgreSQL. It is classified high with a severity score of 6.5 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Privilege escalation;
- Disclosure of sensitive information;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- Drupal version 8.9.0 and later, prior to 10.4.10;
- Drupal version 10.5.0 and later, prior to 10.5.10;
- Drupal version 10.6.0 and later, prior to 10.6.9;
- Drupal version 11.0.0 and later, prior to 11.1.10;
- Drupal version 11.2.0 and later, prior to 11.2.12;
- Drupal version 11.3.0 and later, prior to 11.3.10;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Drupal Core to the latest available version;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.