EUVD-2026-31153
GHSA-ghwc-95x2-682j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable SQL injection (AV:N/AC:L/PR:N/UI:N) allowing database read, modification, and disruption yields high confidentiality, integrity, and availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
9DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.
This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Articles & Coverage 1
AnalysisAI
SQL injection in Drupal core (versions 8.9.0 through the fixed 10.4.10/10.5.10/10.6.9 and 11.x branches through 11.3.10) allows attackers to inject arbitrary SQL against the site database, per SA-CORE-2026-004. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code (Exploit-DB 52608 and multiple public PoCs), and the CVSS 9.8 vector indicates unauthenticated remote exploitation. Notably, EPSS remains extremely low (0.01%) and SSVC lists exploitation as 'none', signaling either targeted rather than widespread activity or conflicting source data that defenders should treat cautiously while still prioritizing the patch given KEV status.
Technical ContextAI
Drupal core is a widely deployed PHP content management framework backed by a relational database accessed through its database abstraction layer (the Database API and its query builders). This vulnerability is a CWE-89 SQL Injection: improper neutralization of special elements in a SQL command, meaning attacker-controlled input reaches a query without adequate parameterization or escaping. The single CPE (cpe:2.3:a:drupal:drupal_core:*:*:*:*:*:*:*:*) confirms the defect is in core itself rather than a contributed module, so it affects the base platform used by every Drupal installation in the listed version ranges regardless of which contrib modules are enabled. Root cause of the CWE-89 class is dynamic query construction that concatenates untrusted data instead of using bound parameters/prepared statements.
RemediationAI
Upgrade Drupal core to a fixed release for your branch: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10 (Vendor-released patch per SA-CORE-2026-004 at https://www.drupal.org/sa-core-2026-004); sites still on 8.9.x/9.x/early 10.x should move to at least 10.4.10. Because this is confirmed in the CISA KEV catalog with public exploits, patch on an emergency timeline and prioritize internet-facing sites. If immediate patching is not possible, restrict access to the site (place it behind authentication, VPN, or IP allowlisting) and deploy a WAF rule set to detect and block SQL injection patterns against Drupal endpoints as an interim control - noting that WAF signatures can be bypassed and may cause false positives on legitimate content, so they are a stopgap, not a substitute for the update. After patching, review database logs and audit for signs of prior compromise (unexpected users, altered content, exfiltration) given active exploitation, and rotate credentials if intrusion is suspected.
More in Drupal Core
View allObject injection in Drupal Core across branches 8.0.0 through 11.3.x allows a network-accessible, highly privileged auth
Cross-site scripting in Drupal core 11.3.0 through 11.3.6 enables unauthenticated remote attackers to inject malicious s
Cross-site scripting in Drupal Core exposes a broad range of Drupal installations - spanning major versions 8 through 11
Object injection in Drupal Core through improperly controlled modification of dynamically-determined object attributes (
Object injection via a mass assignment flaw in Drupal Core enables an authenticated administrator to manipulate dynamica
Open redirect in Drupal Core across multiple major release branches enables phishing and content spoofing attacks by for
Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute
Cross-site scripting (XSS) in Drupal Core affects a broad swath of the 10.x and 11.x release lines, enabling an authenti
Cross-site scripting in Drupal Core across all maintained 11.x release branches allows network-accessible unauthenticate
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x t
Server-Side Request Forgery in Drupal Core allows authenticated low-privilege users to coerce the application server int
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today