Location Selector EUVD-2026-43076

The target Drupal site must have the Location Selector contrib module installed and enabled (versions 0.0.0 through 1.3.0), and the vulnerable input path must be reachable by the attacker; no authentication is required (PR:N) and no user interaction is needed (UI:N). Exploitation is limited by the CVSS high attack complexity (AC:H), meaning success depends on non-obvious preconditions - likely a specific input, request state, or configuration of the module - so it is not a guaranteed one-shot injection against every deployment. It does not affect Drupal core or sites without this module.

Signals are mixed but net moderate. The CVSS vector (AV:N/PR:N/UI:N) shows unauthenticated network reachability with confidentiality and integrity impact (C:H/I:H), but AC:H indicates the attack is not trivially reliable and depends on specific conditions or timing, which tempers the raw 7.4 score. Corroborating this, EPSS is low (0.19%, 9th percentile), there is no KEV listing (not confirmed actively exploited) and no public exploit identified at time of analysis, so this is a credible but not urgent priority - patch on a normal cycle unless the module is internet-facing on a sensitive site. Note a possible tension worth verifying: SQLi with PR:N is often assessed at AC:L, so the vendor's AC:H suggests non-obvious preconditions (e.g., a specific configuration or input path) that defenders should confirm against the drupal.org advisory.

A remote, unauthenticated attacker crafts requests to a Drupal page served by the Location Selector module, embedding SQL payloads in an input parameter that the module concatenates into a query. Successful injection lets them read sensitive database contents (user records, session or configuration data) and tamper with stored data. The AC:H rating implies the payload must satisfy specific conditions to trigger reliably, and no public exploit is identified at time of analysis.