Geolocation Field CVE-2026-13242

The Drupal Geolocation Field contributed module must be installed and enabled on the target Drupal site, running any version from 0.0.0 up to but not including 3.15.0. Based on the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation does not require authentication and works against network-reachable instances with no special attacker setup. The scope is limited (S:U) to the Drupal database, with partial confidentiality and integrity impact only - full database control or remote code execution are not indicated by C:L/I:L/A:N. The primary limiting factors are: (1) the Geolocation Field module must actually be installed - it is a contributed module, not present in default Drupal installations; (2) the vulnerable functionality must be reachable via a public-facing path or endpoint; and (3) the bounded C:L/I:L impact suggests the injection may be constrained by database user privileges or query context rather than enabling arbitrary SQL execution.

The CVSS 6.5 Medium score reflects a meaningful but bounded risk profile: network-reachable (AV:N), low complexity (AC:L), no authentication required (PR:N), no user interaction needed (UI:N), but limited to partial confidentiality and integrity impact (C:L/I:L) with no availability impact. EPSS at 0.16% (5th percentile) is very low, indicating that despite the PR:N surface, exploitation has not become widespread or commoditized at time of analysis. There is no CISA KEV listing and no publicly identified proof-of-concept code, which is consistent with the low EPSS. The realistic priority depends on whether the affected module is installed and whether any geolocation-driven public pages or API endpoints exist on the site. Sites with the module installed and public-facing geolocation views should treat this as a higher priority than the EPSS alone implies, given the zero-barrier attack conditions. Sites that restrict geolocation content to authenticated users may face lower practical risk, though the CVSS vector does not confirm that restriction as a universal constraint.

An unauthenticated attacker discovers a Drupal site running the Geolocation Field module by identifying characteristic Drupal paths or module-specific URL patterns. The attacker submits a crafted HTTP request with SQL injection payloads embedded in a geolocation-related query parameter, which is incorporated unsanitized into a database query. This allows the attacker to enumerate database tables, extract user credentials or site content, or modify existing database records without requiring any prior login.