GitHub Advisoryadvisory · Packagist

GHSA-ghwc-95x2-682j Drupal Core has a SQL Injection issue

CRITICAL Published 2026-05-20 Modified 2026-06-18 Official page ↗
Aliases
CVE-2026-9082
Ecosystem
Packagist
Packages
drupal/core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2026-06-18

Affected packages

• Packagist drupal/core: >= 8.9.0, < 10.4.10 → fixed in 10.4.10 • Packagist drupal/core: >= 10.5.0, < 10.5.10 → fixed in 10.5.10 • Packagist drupal/core: >= 10.6.0, < 10.6.9 → fixed in 10.6.9 • Packagist drupal/core: >= 11.0.0, < 11.1.10 → fixed in 11.1.10 • Packagist drupal/core: >= 11.2.0, < 11.2.12 → fixed in 11.2.12 • Packagist drupal/core: >= 11.3.0, < 11.3.10 → fixed in 11.3.10

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Related

Alias · CVE (1)

  • CVE-2026-9082 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References