EUVD-2026-31153
GHSA-ghwc-95x2-682j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.
This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Articles & Coverage 1
AnalysisAI
SQL injection in Drupal Core across six major version branches (8.9.0 through 11.3.x) enables remote unauthenticated attackers to manipulate database queries with no required privileges or user interaction, as confirmed by CVSS vector AV:N/AC:L/PR:N/UI:N. The vulnerability yields partial confidentiality and integrity impact per CVSS - enabling data enumeration and limited data manipulation - but does not grant full database control or server compromise. No active exploitation is confirmed (not listed in CISA KEV; SSVC exploitation status: none), but SSVC flags this as automatable, making opportunistic mass scanning against the large global Drupal install base a credible near-term risk.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements in SQL Commands) identifies the root cause as insufficient sanitization or parameterization of user-supplied input before it is incorporated into SQL queries within Drupal's core database abstraction layer. Drupal core (CPE: cpe:2.3:a:drupal:drupal_core) wraps PDO for database operations, but the flaw indicates that one or more code paths in core bypass parameterized query construction, allowing injected SQL metacharacters to alter query logic. The breadth of the affected version range - spanning from the legacy 8.9.x branch through current 11.3.x releases - strongly suggests the vulnerable code originates in a shared query-building utility or module used across all major Drupal release lines, rather than a feature introduced in a single release cycle.
RemediationAI
The primary fix is to upgrade Drupal core to one of the following patched releases, depending on the installed branch: 10.4.10, 10.5.10, or 10.6.9 for 10.x installations; 11.1.10, 11.2.12, or 11.3.10 for 11.x installations. Sites still running 8.9.x are on an end-of-life branch and must migrate to a currently supported and patched release as an urgent priority. Full upgrade instructions and security changelog are available at https://www.drupal.org/sa-core-2026-004. Patch availability is confirmed by the vendor advisory; exact fix version numbers are sourced directly from that advisory and EUVD-2026-31153. If immediate patching is not feasible, deploying a WAF with SQL injection detection rules (e.g., ModSecurity with OWASP CRS ruleset) can reduce exposure, though WAF bypass is possible and this is not a substitute for patching. Additionally, restricting the database service account to minimum required privileges - specifically preventing SELECT on sensitive tables not needed by the application and denying INSERT/UPDATE/DELETE where not required - limits the impact of any successful injection. Restricting unauthenticated access to query-exposed endpoints via IP allowlisting further reduces the attack surface.
More in Drupal Core
View allObject injection in Drupal Core across branches 8.0.0 through 11.3.x allows a network-accessible, highly privileged auth
Cross-site scripting in Drupal core 11.3.0 through 11.3.6 enables unauthenticated remote attackers to inject malicious s
Cross-site scripting in Drupal Core exposes a broad range of Drupal installations - spanning major versions 8 through 11
Object injection in Drupal Core through improperly controlled modification of dynamically-determined object attributes (
Object injection via a mass assignment flaw in Drupal Core enables an authenticated administrator to manipulate dynamica
Open redirect in Drupal Core across multiple major release branches enables phishing and content spoofing attacks by for
Cross-site scripting (XSS) in Drupal Core affects a broad swath of the 10.x and 11.x release lines, enabling an authenti
Server-Side Request Forgery in Drupal Core allows authenticated low-privilege users to coerce the application server int
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today