EUVD-2026-43066
GHSA-hccw-5cx2-v346
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable with no auth per Drupal's public-facing views pattern; limited C:L/I:L reflects bounded SQL injection impact without full DB control.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
5DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.
AnalysisAI
SQL injection in the Drupal Geolocation Field contributed module exposes sites to unauthenticated database read and partial write access across all module versions prior to 3.15.0. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction, making it remotely triggerable against any publicly reachable Drupal installation running the affected module. Impact is bounded by C:L/I:L/A:N - partial data disclosure and modification without availability disruption or full database takeover. No active exploitation has been confirmed (no CISA KEV listing), and EPSS sits at a low 0.16% (5th percentile), indicating minimal current attacker interest. A vendor patch is available.
Technical ContextAI
The Drupal Geolocation Field module (CPE: cpe:2.3:a:drupal:geolocation_field:*:*:*:*:*:*:*:*) provides a field type for storing and displaying geographic coordinates within the Drupal CMS framework. CWE-89 (Improper Neutralization of Special Elements in SQL Command) identifies the root cause as unsanitized user-controlled input being interpolated directly into SQL query strings rather than handled through parameterized queries or Drupal's database abstraction layer (DBAL). This class of flaw in a contributed module typically manifests in custom query-building code that bypasses Drupal core's db_select/db_query safeguards. Because Drupal's contributed modules often expose data through public-facing views and REST endpoints, the attack surface can be reachable without authentication depending on site configuration.
RemediationAI
Upgrade the Geolocation Field module to version 3.15.0 or later, which contains the vendor-released patch as confirmed by the Drupal security advisory at https://www.drupal.org/sa-contrib-2026-062. Drupal sites can update contributed modules via Composer (composer update drupal/geolocation) or through the Drupal admin update interface. If immediate patching is not feasible, consider temporarily disabling the Geolocation Field module to eliminate the attack surface - note this will break any geolocation-dependent content or views on the site. Alternatively, deploying a web application firewall rule targeting SQL injection patterns on Drupal request paths can reduce exploitability without disabling functionality, though WAF-based mitigations are not a substitute for patching. Review Drupal access permissions to restrict geolocation-related pages or views to authenticated roles where possible, which would raise the effective privilege bar even if it does not eliminate the underlying flaw.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today