GitHub Advisoryadvisory · Packagist
GHSA-ghwc-95x2-682j Drupal Core has a SQL Injection issue
CRITICAL
Official page ↗
- Aliases
- CVE-2026-9082
- Ecosystem
- Packagist
- Packages
- drupal/core
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
- Reviewed
- 2026-06-18
Affected packages
• Packagist drupal/core: >= 8.9.0, < 10.4.10 → fixed in 10.4.10
• Packagist drupal/core: >= 10.5.0, < 10.5.10 → fixed in 10.5.10
• Packagist drupal/core: >= 10.6.0, < 10.6.9 → fixed in 10.6.9
• Packagist drupal/core: >= 11.0.0, < 11.1.10 → fixed in 11.1.10
• Packagist drupal/core: >= 11.2.0, < 11.2.12 → fixed in 11.2.12
• Packagist drupal/core: >= 11.3.0, < 11.3.10 → fixed in 11.3.10
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.
This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Related
Alias · CVE (1)
- CVE-2026-9082 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL… vulnerability
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness